CapConsole.dll -------------- "Capture console" saves console output and std_error output to file console.log. Imagine you have console application rebase.exe, you can't read output so quickly, rebase.exe >help.txt doesn't work because rebase.exe writes to console or to std_error. Then type: ApiHooks -n CapConsole.dll c:\sdktools\rebase.exe ren console.log help.txt and you're done. Because export of kernel32 is not modified (no HOOK_EXPORT, moreover kernel32 lies in shared memory in 9x) hooking of GetProcAddress is implemented to ensure working even if rebase.exe is packed (or simply uses GetProcAddr on implemented console functions).