  Description of Examples\F-Advanced
  ----------------------------------


C subdirectory:
===============

ProcLog
-------
logs process creation in Win9x. 1 hard-9xglobal hook is used.
This hook intercepts any call to any Win32 function that can spawn
process (CreateProcessA, WinExec, LoadModule and all wrappers
like ShellExecute). This RAW hook was used in Delphi\HookShellAboutSpec
example from AH38 package. ProcLog is very similar to ASM\CapCon example.
Creation of console procesess (like START.exe) from COMMAND.com isn't
implemented via Win32 APIs mentioned above - isn't logged.



SesOff
------
tries to log specified session off by calling ExitWindowsEx(EWX_LOGOFF,..)
in user process of given session. ExitWindowsEx (and many other functions,
like creating process or thread or working with console) requires calling
thread to be Win32. This is true for current session but not for any other
sessions. How to register remote (intersession) thread in its CSR server
is showed in HDK\INC\MakeWin32.h C++ header file. I haven't found simplier
technique yet. SesOff requires "Debug programs" right assigned. SesOff
wasn't tested on XP.


NtLoad
------
tries to load specified module into specified process in NT. If the process is native
it is turned into Win32. Again MakeWin32.h is used, but now also for registering
native process. Try for example:  NtLoad smss.exe rpcrt4 or NtLoad os2ss.exe gdi32.
NtLoad requires "Debug programs" right assigned. NtLoad wasn't tested on XP.
