There's a world of difference between hooking a message loop and hooking a Win32 function: You can hook a message loop using regular Win32 APIs, while hooking

There's a world of difference between hooking a message loop and hooking a Win32 function: You can hook a message loop using regular Win32 APIs, while hooking a Win32 API requires you to modify code in the process. Specifically you need to inject a trampoline function into the process memory and then overwrite the first two bytes of the Win32 function you'd like to hook with a jump instruction to your trampoline. The former is a lot easier to allow while the latter is much more likely to open the flood gates for cheats.