PsSetCreateThreadNotifyRoutine routine

The PsSetCreateThreadNotifyRoutine routine registers a driver-supplied callback that is subsequently notified when a new thread is created and when such a thread is deleted.

Syntax


NTSTATUS PsSetCreateThreadNotifyRoutine(
  _In_  PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine
);

Parameters

NotifyRoutine [in]

Specifies the entry point of the caller-supplied thread-creation callback.

Return value

PsSetCreateThreadNotifyRoutine either returns STATUS_SUCCESS or it returns STATUS_INSUFFICIENT_RESOURCES if it failed the callback registration.

Remarks

Highest-level drivers can call PsSetCreateThreadNotifyRoutine to set up their thread-creation notify routines, declared as follows:


VOID
(*PCREATE_THREAD_NOTIFY_ROUTINE) (
    IN HANDLE  ProcessId,
    IN HANDLE  ThreadId,
    IN BOOLEAN  Create
    );

For example, an IFS or highest-level system-profiling driver might register such a thread-creation callback to track the system-wide creation and deletion of threads against the driver's internal state.

A driver must remove any callbacks it registers before it unloads. You can remove the callback by calling the PsRemoveCreateThreadNotifyRoutine routine.

The driver's thread-notify routine runs at IRQL = PASSIVE_LEVEL. When a thread is created, the thread-notify routine runs in the context of the thread that created the new thread. When a thread is deleted, the thread-notify routine runs in the context of this thread when the thread exits.

Requirements

Version

Available starting with Windows 2000.

Header

Ntddk.h (include Ntddk.h)

Library

Ntoskrnl.lib

IRQL

PASSIVE_LEVEL

DDI compliance rules

IrqlPsPassive, PowerIrpDDis, HwStorPortProhibitedDDIs

See also

PsGetCurrentProcessId
PsGetCurrentThreadId
PsIsSystemThread
PsRemoveCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft