对Hook API 感兴趣的可以看看APISpy32 , free source code，另外还有一篇绝佳的文章, 来自Win32系统编程的著名站点。这个APISpy32至少已经存在4年了，我很早就用过，极好。
Source code: http://www.internals.com/utilities/winnt/apispy32/APISpy32.zip
API spying utilities are the most powerful tools for exploring the internal structure of applications and operating systems. They provide tons of information and enable the user to explore the "guts" of the application under test. Unfortunately, most API spying utilities can monitor only one application at a time and also have the tendency to break apart when used with large pieces of code. APISpy32 is a different type of API interceptor which solves most of these problems. It monitors API calls made by ALL active Windows applications and logs the values of input parameters. This version works under Windows 9x/NT/2000 and ME.