mumadiy1

可以实现内核钩子的检测，分为应用层和驱动层，带源码(Can detect the kernel hooks, into the application layer and the driver layer, with source code)

win32 Hook api 钩子与API截获 (win32 Hook api)

hook clavier under vb.net

一个简单的开机保护程序 无任何控件 全api编写 关键字 ：键盘钩子， dll注入，api函数 api操作注册表, windows消息(a simple reboot protection procedures without any controls all api prepared keyword : keyboard hook, dll implantation, api function api operate the registry, windows news)

在VC下类似金山词霸屏幕取词功能的鼠标钩子(Mouse hook in capturing function of the VC.)

强制删除文件，无注入无驱动无hook，原理就是查找文件的锁定句柄，然后关闭句柄。(Forced to delete the file, no injection no driver no hook, the principle is to find the file lock handle, and then close the handle.)

屏幕录制，远程桌面传输，基于Windows图形驱动的屏幕截图技术,api hook,win32 gdi ,mirrorDriver(Screen recording, remote desktop transmission, based on the Windows graphics driver screenshots technology, api hook, win32 gdi, mirrorDriver)

一个通过hook ndis层来达到监控的工具，代码不错(a tool for hook ndis)

基于句柄类的文本查询示例（C++ Primer 4th）(Text handle classes of queries based on the sample (C++ Primer 4th) )

先从键盘输入一个文本文件的文件名(约定：字符数≤127字节，可含路径)和一个字符串(约定：字符数≤20字节，其中不含空格、TAB等，后面称之为Str)，再在屏幕上显示该文件的内容。要求显示完内容后，在屏幕上输出文件的行数(行之间以’ ’为分隔、每行的长度不定但均≤200个字节)、字符串Str在文件中第1次出现的行号和最后一次出现的行号(查找时不区分大小写、不跨行查找，若未找到，则行号显示为-1)。 (Start with the keyboard input of a text file name (convention: the number of characters to ≤ 127 bytes, and can contain the path) and a string (convention: the number of characters ≤ 20 bytes, which contain spaces, TAB, followed by call Str), the contents of the file is displayed on the screen. Requests display content on the screen the number of rows of the output file (the line between ' n' separated, each line has a variable length but ≤ 200 bytes) string Str file a (find the line number and the last line number is not case-sensitive, cross-bank does not find, If you do not find the line number is displayed as-1).)