User interface for Pogy: API spying program

API spying through hooking imported API functions

API spying through hooking all API calls: you can see how LoadBitmapA is implemented (using GetDC, CreateCompatibleBitmap,...),

and how SetDIBits is implemented (using SetDIBitsToDevice).

DDIWatcher.EXE: Accessing per device context DDI function table

(functions with address 0xaxxxxxxx are implemented by Win32K.SYS, while other functions are implemented by display/printer driver).

DDIWatcher: hooking into DDI interface with a kernel mode driver, name of DDI functions called.