The principle is easy, but writing codes is too tired.
I can tell you some methods:
1. Use System Global Hook to Map your DLL to the EXE
2. Write a Debugger to load the target EXE. When stopping just after loading,
use CreateRemoteThread API to inject your codes into EXE. This method
is described in "Advacned Windows NT".
3. ....etc
