[St1mul]

Я бросил уже затею с получением потока.
Выложи лучше ты свои, если у тебя получилось
Вот недоделанные исходники на FASM c SetWindowsHookEx
exe:

format pe gui 4.0
entry start
include 'win32a.inc'
ThreadID = 2004 ; - поток на который хотим поставить ловушку
section '.data' data readable writeable
Name1		db 'Hook.dll',0
Hook		dd ?
Name2		db 'Hook.txt',0
Handle2 	dd ?
var1		dd ?
msg1		db 'Prees to unhook',0
msg2		db 'Hook',0
section '.code' code readable executable
start:
	invoke GetModuleHandleA,Name1
	invoke SetWindowsHookExA,WH_KEYBOARD,Hooking,eax,ThreadID
	mov [Hook],eax
	invoke CreateFileA,Name2,GENERIC_WRITE,FILE_SHARE_WRITE,0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
	mov [Handle2],eax
	invoke WriteFile,eax,Hook,4,var1,0
	mov eax,[Handle2]
	invoke CloseHandle,eax
	invoke MessageBoxA,0,msg1,msg2,MB_OK
	mov eax,[Hook]
	invoke UnhookWindowsHookEx,eax
	invoke ExitProcess,0

section '.idata' import data readable writeable
	 library kernel32,'kernel32.dll',\
		 user32,'user32.dll',\
		 Hook,'Hook.dll'
	 import  kernel32,\
		 ExitProcess,'ExitProcess',\
		 GetModuleHandleA,'GetModuleHandleA',\
		 LoadLibraryA,'LoadLibraryA',\
		 CreateFileA,'CreateFileA',\
		 WriteFile,'WriteFile',\
		 GetProcAddress,'GetProcAddress',\
		 CloseHandle,'CloseHandle',\
		 GetCurrentThreadId,'GetCurrentThreadId'
	 import  user32,\
		 MessageBoxA,'MessageBoxA',\
		 SetWindowsHookExA,'SetWindowsHookExA',\
		 UnhookWindowsHookEx,'UnhookWindowsHookEx'
	 import Hook,\
		Hooking,'Hooking'

DLL:

format PE GUI 4.0 DLL
entry DllEntryPoint
include 'win32a.inc'
section '.data' data readable writeable
msg		db 'Hook works',0
msg1		db 'Nice',0
Name1		db 'Hook.txt',0
var1		dd ?
Hook		dd ?
var2		dd ?
Name2		db 'Hook.dll',0
LRESULT 	dd ?

section '.code' code readable executable
proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
     cmp [fdwReason],1
     jnz bad
     mov eax,[hinstDLL]
     invoke DisableThreadLibraryCalls,eax
     jmp bad
bad:
     mov eax,1
     pop ebp
     ret 12
endp
;=========================================================

proc Hooking stdcall nCode,wparam,lparam
     invoke MessageBox,0,msg,msg1,MB_OK
     invoke OpenFile,Name1,var1,OF_READ
     invoke ReadFile,eax,Hook,4,0,0
     mov ebx,[Hook]
     mov eax,[nCode]
     mov ecx,[wparam]
     mov edx,[lparam]
     invoke CallNextHookEx,ebx,eax,ecx,edx
     mov [LRESULT],eax
     ret
endp
;==========================================================

section '.idata' import data readable writeable
	 library kernel32,'kernel32.dll',\
		 user32,'user32.dll'
	 import  kernel32,\
		 ExitProcess,'ExitProcess',\
		 LoadLibraryA,'LoadLibraryA',\
		 GetModuleHandleA,'GetModuleHandleA',\
		 FreeLibrary,'FreeLibrary',\
		 OpenFile,'OpenFile',\
		 ReadFile,'ReadFile',\
		 DisableThreadLibraryCalls,'DisableThreadLibraryCalls'
	 import  user32,\
		 MessageBox,'MessageBoxA',\
		 UnhookWindowsHookEx,'UnhookWindowsHookEx',\
		 RegisterWindowMessageA,'RegisterWindowMessageA',\
		 CallNextHookEx,'CallNextHookEx'


;==========================================================
section '.edata' export data readable
	export 'Hook.DLL',\
	Hooking,'Hooking'
	dd LRESULT

section '.reloc' fixups data discardable

ThreadID можно получить с помощью WinSpy (в атаче ) Переводим из 16ричной системы в 10 и записываем в екзешник в константу ThreadId