PsSetCreateThreadNotifyRoutine function (ntddk.h)
The PsSetCreateThreadNotifyRoutine routine registers a driver-supplied callback that is subsequently notified when a new thread is created and when such a thread is deleted.
Syntax
NTSTATUS PsSetCreateThreadNotifyRoutine(
[in] PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine
);
Parameters
[in] NotifyRoutine
A pointer to the driver's implementation of PCREATE_THREAD_NOTIFY_ROUTINE routine.
Return value
PsSetCreateThreadNotifyRoutine either returns STATUS_SUCCESS or it returns STATUS_INSUFFICIENT_RESOURCES if it failed the callback registration.
Remarks
Highest-level drivers can call PsSetCreateThreadNotifyRoutine to set up their thread-creation notify routines, declared as follows:
VOID
(*PCREATE_THREAD_NOTIFY_ROUTINE) (
IN HANDLE ProcessId,
IN HANDLE ThreadId,
IN BOOLEAN Create
);
For example, an IFS or highest-level system-profiling driver might register such a thread-creation callback to track the system-wide creation and deletion of threads against the driver's internal state.
A driver must remove any callbacks it registers before it unloads. You can remove the callback by calling the PsRemoveCreateThreadNotifyRoutine routine.
Requirements
| Requirement | Value |
|---|---|
| Target Platform | Universal |
| Header | ntddk.h (include Ntddk.h) |
| Library | NtosKrnl.lib |
| DLL | NtosKrnl.exe |
| IRQL | PASSIVE_LEVEL |
| DDI compliance rules | HwStorPortProhibitedDDIs(storport), IrqlPsPassive(wdm), PowerIrpDDis(wdm) |
See also
PsRemoveCreateThreadNotifyRoutine