Comment by ianhanschen

Looks cool. If you want to get rid of your hook DLLs and the need for the x86ipc child process, you can use SetWinEventHook() with EVENT_OBJECT_CREATE / EVENT_OBJECT_DESTROY as min/max event values and WINEVENT_OUTOFCONTEXT to get notification on newly created/destroyed windows, all within the context of your process. No hook DLLs required.