PsSetCreateThreadNotifyRoutineEx function (ntddk.h)
The PsSetCreateThreadNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified when a new thread is created and when such a thread is deleted.
Syntax
NTSTATUS PsSetCreateThreadNotifyRoutineEx(
[in] PSCREATETHREADNOTIFYTYPE NotifyType,
[in] PVOID NotifyInformation
);
Parameters
[in] NotifyType
A PSCREATETHREADNOTIFYTYPE value that indicates the type of thread notification.
[in] NotifyInformation
Provides the address of the notification information for the specified type of thread notification. If NotifyType is PsCreateThreadNotifyNonSystem or PsCreateThreadNotifySubsystems then NotifyInformation should be a pointer to the driver's implementation of PCREATE_THREAD_NOTIFY_ROUTINE.
Return value
PsSetCreateThreadNotifyRoutineEx either returns STATUS_SUCCESS or it returns STATUS_INSUFFICIENT_RESOURCES if it failed the callback registration.
Remarks
Highest-level drivers can call PsSetCreateThreadNotifyRoutineEx to set up their thread-creation notify routines.
For example, an IFS or highest-level system-profiling driver might register such a thread-creation callback to track the system-wide creation and deletion of threads against the driver's internal state.
If NotifyType is PsCreateThreadNotifyNonSystem, the PsSetCreateThreadNotifyRoutineEx routine differs from PsSetCreateThreadNotifyRoutine in the context in which the callback is executed. With PsSetCreateThreadNotifyRoutine, the callback is executed on the creator thread. With PsSetCreateThreadNotifyRoutineEx, the callback is executed on the newly created thread.
A driver must remove any callback function it registers before it unloads. You can remove the callback by calling the PsRemoveCreateThreadNotifyRoutine routine.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Available starting with Windows 10. |
| Target Platform | Universal |
| Header | ntddk.h (include Ntddk.h) |
| Library | NtosKrnl.lib |
| DLL | NtosKrnl.exe |
| IRQL | PASSIVE_LEVEL |
See also
PsRemoveCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine