PsSetCreateThreadNotifyRoutine function (ntddk.h)

Article
02/22/2024

The PsSetCreateThreadNotifyRoutine routine registers a driver-supplied callback that is subsequently notified when a new thread is created and when such a thread is deleted.

Syntax

NTSTATUS PsSetCreateThreadNotifyRoutine(
  [in] PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine
);

Parameters

[in] NotifyRoutine

A pointer to the driver's implementation of PCREATE_THREAD_NOTIFY_ROUTINE routine.

Return value

PsSetCreateThreadNotifyRoutine either returns STATUS_SUCCESS or it returns STATUS_INSUFFICIENT_RESOURCES if it failed the callback registration.

Remarks

Highest-level drivers can call PsSetCreateThreadNotifyRoutine to set up their thread-creation notify routines, declared as follows:

VOID
(*PCREATE_THREAD_NOTIFY_ROUTINE) (
    IN HANDLE  ProcessId,
    IN HANDLE  ThreadId,
    IN BOOLEAN  Create
    );

For example, an IFS or highest-level system-profiling driver might register such a thread-creation callback to track the system-wide creation and deletion of threads against the driver's internal state.

A driver must remove any callbacks it registers before it unloads. You can remove the callback by calling the PsRemoveCreateThreadNotifyRoutine routine.

Requirements

Requirement	Value
Target Platform	Universal
Header	ntddk.h (include Ntddk.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	PASSIVE_LEVEL
DDI compliance rules	HwStorPortProhibitedDDIs(storport), IrqlPsPassive(wdm), PowerIrpDDis(wdm)