The CLR uses a similar technique to take over control of execution of a managed EXE - http://srevas.net/notes/2007/12/25/mscoree/