Create/End Process callback Pssetcreateprocessnotifyroutine

Pssetcreateprocessnotifyroutine

Pssetcreateprocessnotifyroutine Adds or removes a driver-supported callback routine (which can also be a function).

When a process is created or deleted, a sequence of routines is called. PS: the equivalent of adding a routine to a linked list, when the process is created or deleted, all routines are called (this should be the meaning)

NTSTATUS
Pssetcreateprocessnotifyroutine (
In Pcreate_process_notify_routine Notifyroutine, the entry address of the routine function,
In BOOLEAN remove false, add a routine to the linked list, TRUE, to delete the routine from the linked list
);

return value:

status_success routines are registered to the system
The Status_invalid_parameter routine has been registered, so this routine is redundant, or has reached the upper limit of the number of registrations.

Commentary:

The most advanced driver can call Pssetcreateprocessnotifyroutine to set up their process creation notification routines, declared as follows:

VOID
(*pcreate_process_notify_routine) (
In HANDLE ParentID,
In HANDLE ProcessId,
In BOOLEAN Create
);

ParentID and ProcessID used toDetermine the process, and the Create parameter indicates whether the process was created or deleted.

An IFS or superlative system-profiling driver may register a process-creation callback to track the system-wide creation and deletion process rather than the driver's internal,
For both Vista and subsequent versions, the system can create up to 64 system creation callbacks.

A driver must remove all of its registered routines before unloading, and you can remove the routine by calling pssetcreateprocessnotify (remove = TRUE).

When Create is true, the routine is called after the initialization thread of the newly created process (the ProcessID handle is specified) is created.

When Create is false, the routine is called when the last thread of the process is closed and the address space of the process is freed.

The process notification routines for a process run in IRQL = Passive_level, when a process is created and the routine runs in the thread context of the newly created process.

When a process is deleted, the routine runs in the last thread of the process (which is about to exit the process).

Create/End Process callback Pssetcreateprocessnotifyroutine