PCREATE_THREAD_NOTIFY_ROUTINE callback function (ntddk.h)
A callback routine implemented by a driver to notify the caller when a thread is created or deleted.
Warning
The actions that you can perform in this routine are restricted for safe calls. See Best Practices.
Syntax
PCREATE_THREAD_NOTIFY_ROUTINE PcreateThreadNotifyRoutine;
void PcreateThreadNotifyRoutine(
[in] HANDLE ProcessId,
[in] HANDLE ThreadId,
[in] BOOLEAN Create
)
{...}
Parameters
[in] ProcessId
The process ID of the process.
[in] ThreadId
The thread ID of the thread.
[in] Create
Indicates whether the thread was created (TRUE) or deleted (FALSE).
Return value
None
Remarks
Highest-level drivers can call PsSetCreateThreadNotifyRoutine or PsSetCreateThreadNotifyRoutineEx to register their thread-creation notify routine.
The driver's thread-notify routine runs at IRQL = PASSIVE_LEVEL or APC_LEVEL. When a thread is created, the thread-notify routine runs in the context of the thread that created the new thread. When a thread is deleted, the thread-notify routine runs in the context of this thread when the thread exits.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Available starting with Windows 2000. |
| Target Platform | Universal |
| Header | ntddk.h (include Ntddk.h) |
| IRQL | <=APC_LEVEL |