How to implement an extensible framework for hooking Win32 API functions.
API Hooking Revealed
Published 12/13/2002
Articles Written by Ivo Ivanov
Detecting Windows NT/2K process execution
Published 03/22/2002
The Win32 API provides a set of great libraries (PSAPI and ToolHelp [1]) that allow you to enumerate processes currently running in the system. Although these APIs are extremely powerful they don't permit you to get notifications when a new process starts or ends up. This article provides an efficient and robust technique based on a documented interface for achieving this goal
Single interface for enumerating processes and modules under NT and Win9x/2K.
Published 10/04/2001
Single interface for enumerating processes and modules under NT and Win9x/2K.
