Dynamic show how to make dynamic hooks. Run runme.bat: Test.exe process is created. Dynamic.dll hooks are applied. Dynamic hooks LoadLibrary functions to catch new module load. Executive part of Dynamic logs CreateFileA. Test.exe loads FileOp.dll and calls a function in it, which opens file. Normally I would miss this file transaction, but helper part (LoadLibrary hooks) of Dynamic catches new module load then it builds DynamicHooks with the name of the new module get current process ID and passes both pointer to DynamicHooks (DYNAMIC_HOOKS constant followed by standard ApiHookChain) and PID to EstablishApiHooks function. The purpose is clear: to hook CreateFileA in the new module. You can compare in Windows 9x (when HOOK_HARD is not used): apihooks.exe -nq mischooks.dll test.exe - createf.log is empty with apihooks.exe -nq dynamic.dll test.exe - createf.log is not empty Both hook dlls log CreateFileA but dynamic doesn't miss CreateFileA calls from the newly loaded module. Under NT there is no difference - both log files are identical. (HOOK_EXPORT works on all modules in NT). If CreateFileA would lay in user space of Windows 9x the situation would be the same.