Hi all, is there a way of reading user application ( IE) messages that go to ntoskrnl or ntdll i. I know each application calls its own instance of dll, but can i map a particular application an read all its systen calls to ntddl or ntoskrnl. If this is possible were can i get info on it. I think VC++ mfc messaging mapping can do it???? thanks in advance.