PsSetCreateThreadNotifyRoutine routine

The PsSetCreateThreadNotifyRoutine routine registers a driver-supplied callback that is subsequently notified when a new thread is created and when such a thread is deleted.

Syntax


NTSTATUS PsSetCreateThreadNotifyRoutine(
  _In_ PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine
);

Parameters

NotifyRoutine [in]

A pointer to the driver's implementation of PCREATE_THREAD_NOTIFY_ROUTINE routine.

Return value

PsSetCreateThreadNotifyRoutine either returns STATUS_SUCCESS or it returns STATUS_INSUFFICIENT_RESOURCES if it failed the callback registration.

Remarks

Highest-level drivers can call PsSetCreateThreadNotifyRoutine to set up their thread-creation notify routines, declared as follows:


VOID
(*PCREATE_THREAD_NOTIFY_ROUTINE) (
    IN HANDLE  ProcessId,
    IN HANDLE  ThreadId,
    IN BOOLEAN  Create
    );

For example, an IFS or highest-level system-profiling driver might register such a thread-creation callback to track the system-wide creation and deletion of threads against the driver's internal state.

A driver must remove any callbacks it registers before it unloads. You can remove the callback by calling the PsRemoveCreateThreadNotifyRoutine routine.

Requirements

Target platform

Universal

Version

Available starting with Windows 2000.

Header

Ntddk.h (include Ntddk.h)

Library

NtosKrnl.lib

DLL

NtosKrnl.exe

IRQL

PASSIVE_LEVEL

DDI compliance rules

IrqlPsPassive, PowerIrpDDis, HwStorPortProhibitedDDIs

See also

PsGetCurrentProcessId
PsGetCurrentThreadId
PsIsSystemThread
PsRemoveCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine

 

 

Send comments about this topic to Microsoft

Show: