You can also do it completely in user mode and only in the process you want.
You can inject the process with a self written dll using the CreateRemoteThread functionality.
Then you can hook the...