BOOL
LRESULT CALLBACK GetMsgProc(int code,WPARAM wParam,LPARAM lParam)
{
	return CallNextHookEx(hHook,code,wParam,lParam);
} 
extern "C"
__declspec(dllexport)
HHOOK InstHook ()
{
	HMODULE hMod = GetModuleHandle("APIHookDll.dll");
	hHook = SetWindowsHookEx(WH_GETMESSAGE,&GetMsgProc,hMod,0);
	return hHook;
}
WINAPI MyCreateProcessInternalW(
								HANDLE hToken,
						LPCTSTR lpApplicationName,
						LPTSTR lpCommandLine,
						LPSECURITY_ATTRIBUTES lpProcessAttributes,
						LPSECURITY_ATTRIBUTES lpThreadAttributes,
						BOOL bInheritHandles,
						DWORD dwCreationFlags,
						LPVOID lpEnvironment,
						LPCTSTR lpCurrentDirectory,
						LPSTARTUPINFO lpStartupInfo,
						LPPROCESS_INFORMATION lpProcessInformation,
						PHANDLE hNewToken
						)
{
	HMODULE hLib = LoadLibrary("kernel32.dll");
	OriCreateProcessInternalW = (_CreateProcessInternalW)GetProcAddress( hLib, "CreateProcessInternalW");
	BOOL bRet=(OriCreateProcessInternalW)(hToken,lpApplicationName,lpCommandLine,NULL,NULL,0,CREATE_SUSPENDED,NULL,lpCurrentDirectory,lpStartupInfo,lpProcessInformation,hNewToken);
	MessageBox(NULL,lpCommandLine,"asdfasdfa",MB_OK);
	return bRet;
}

BOOL APIENTRY DllMain( HANDLE hModule, 
					  DWORD  ul_reason_for_call, 
					  LPVOID lpReserved
					  )
{

	switch( ul_reason_for_call)
	{
	case  DLL_PROCESS_ATTACH:
		{
			hkA.hModCallerModule = NULL;
			hkA.pszAPIName = "CreateProcessInternalW";
			hkA.pszCalleeModuleName = "kernel32.dll";
			hkA.pfnDummyFuncAddress = (PROC) & MyCreateProcessInternalW;
			hkA.pfnOriginApiAddress = GetProcAddress(GetModuleHandle("kernel32.dll"),"CreateProcessInternalW");
			
			if( FALSE == SetWindowsAPIHook(&hkA) )
				MessageBox(NULL,"Hook CreateProcessInternalW失败" ,"Note",0);
			MessageBox(NULL,"1","1",MB_OK);
			
		}
		
		break;
		
	case  DLL_PROCESS_DETACH:
		if( FALSE == UnhookWindowsAPIHooks(hkA) )
			MessageBox(NULL,"UnHook CreateProcessInternalW失败" ,"Note",0);
		break;
		
	default:
		break;
	}
	return TRUE;

}