代码我大致翻了一下，只挂引入表的函数，注入有SetWindowHookEx和CreateRemoteThread两种方式，进程枚举也区分了不同系统下使用的psai和toolhelp，另外为了获得Process的创建消息，做了一个驱动来注册回调函数，总的来说，在注入部分做得相当棒，如果想挂各种函

数，可以结合detour使用。

-Code more or less turned me a little, only linked to the introduction of the function table into SetWindowHookEx and CreateRemoteThread have two ways, the process of enumeration to distinguish between the different systems are used psai and toolhelp, the other in order to obtain the creation of Process message, make a driver to register a callback function, in general, has done quite a part in the injection rod, if want to hang a variety of functions, can be combined to use detour.