the dll just loads in to memory, it is then able to rewrite the binary code in winmx - in reality all it does is rewrite the addresses of some functions winmx calls, so it calls the functions from the patch which then calls the originals (whilst modifying the data in between) in theory anything can be changed in this way, in practice merely modifying data and patching in between winmx and windows to do things isn't the simplest method and it becomes very complicated to make minor changes to winmx (and certain things could not be changed, only completely replaced - which in itself would be extremely complicated)