title: how to intercept that the update of window to the windows driver level?
body: <p>how to intercept that the update of window to the windows driver level?</p>
  
  <p>---windows update
   | 
   --user32.dll
    |
    ---ntdll.dll
  ------------------------------  (intercept point).
      | 
      ----kernel(win32.sys, etc...)</p>
  
  <p>i want to intercept all the update of windows (gdi and ddraw update), then how to implement it?
  i have one suggestion is that i hook gdi update api and ddraw update api separately. but i dot hook gdi update api, i have hook BitBlt, BeginPaint and GetDC, but i can't protect the windows updating. </p>
  
  <p>how to solve the problem?</p>