Edit

PCREATE_THREAD_NOTIFY_ROUTINE callback function (ntddk.h)

  • Article

A callback routine implemented by a driver to notify the caller when a thread is created or deleted.

Warning

The actions that you can perform in this routine are restricted for safe calls. See Best Practices.

Syntax

PCREATE_THREAD_NOTIFY_ROUTINE PcreateThreadNotifyRoutine;

void PcreateThreadNotifyRoutine(
  [in] HANDLE ProcessId,
  [in] HANDLE ThreadId,
  [in] BOOLEAN Create
)
{...}

Parameters

[in] ProcessId

The process ID of the process.

[in] ThreadId

The thread ID of the thread.

[in] Create

Indicates whether the thread was created (TRUE) or deleted (FALSE).

Return value

None

Remarks

Highest-level drivers can call PsSetCreateThreadNotifyRoutine or PsSetCreateThreadNotifyRoutineEx to register their thread-creation notify routine.

The driver's thread-notify routine runs at IRQL = PASSIVE_LEVEL or APC_LEVEL. When a thread is created, the thread-notify routine runs in the context of the thread that created the new thread. When a thread is deleted, the thread-notify routine runs in the context of this thread when the thread exits.

Requirements

Requirement Value
Minimum supported client Available starting with Windows 2000.
Target Platform Universal
Header ntddk.h (include Ntddk.h)
IRQL <=APC_LEVEL

See also

PsSetCreateThreadNotifyRoutine

PsSetCreateThreadNotifyRoutineEx