I agree, we should hook user32.dll.
I have some code that does the following:
1) Uses Windows Hooks (designed for Computer-Based Training
etc) to get
loaded
into program as soon as the program creates a window, then calls 2)
2) Updates the address table to redirect certain functions
from desired dlls
Basically we want to replace 1) with a program that loads the program
and then does 2)
This would then be "wrapX11"
This way we don't have to rename user32.dll to user32-real.dll and
replace it with our own,
we just add user32-X11.dll in and make it replace certain functions.
Sounds better.
* Would not require a reboot to install / test
* Is less likely to break when a service pack upgrades user32.dll
Also, doesn't give hassles with Windows File Protection under 2000+ (even