 Exec shows that children aren't hooking problem and you can catch them too.
After running runme.bat two sets of message boxes will be displayed. The 1st
set is not hooked, the 2nd is. Exec.dll contains hooks for CreateProcess,
LoadModule, WinExec, ShellExecute and MessageBox. It is applied to Main.exe.
Main.exe runs 4 Children. They are hooked too.
 There can be problems with system memory. If there is not enough nonpaged
memory to lock user buffers (for system information or process snapshot)
loading module/establishing hooks from ApiHooks or later from Main.exe can
fail. Example: The 2nd set is OK but Child4 isn't hooked - it's because call
to ShellExecute forced loading of the next DLLs into Main.exe -> consumed
several locked pages ("SHELL32 eats memory"). In more critical situation,
hooks can't be applied even to Main.exe (AH error message box appears) because
memory was exhausted by 1st set already. Solution is to free some nonpaged
memory, for example by unloading unused drivers.