Edit

Share via

PsGetProcessStartKey function (ntddk.h)

  • Article

This routine generates an identifier for a process which is unique across boot sessions.

Syntax

ULONGLONG PsGetProcessStartKey(
  [in] PEPROCESS Process
);

Parameters

[in] Process

A pointer to the EPROCESS structure that represents the process. Drivers can use the PsGetCurrentProcess and ObReferenceObjectByHandle routines to obtain a pointer to the EPROCESS structure for a process.

Return value

Returns a ULONGLONG specifying a unique identifier for the provided process.

Remarks

Here is an example of how a driver might call this routine:

ULONGLONG ProcessStartKey;
ProcessStartKey = PsGetProcessStartKey(PsGetCurrentProcess());

The process start key is typically used to track or identify a process over time.

Requirements

Requirement Value
Minimum supported client Windows 10, version 1703
Header ntddk.h
IRQL <= DISPATCH_LEVEL