IDkmProcessCreateNotification Interface
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
IDkmProcessCreateNotification is implemented by components that want to listen for the ProcessCreate event. When this notification fires, the target process will be suspended and can be examined. ProcessCreate is fired when a DkmProcess object is created. This indicates that the debugger has started attaching to the specified process. In launch scenarios, this event is fired before any code in the target process is allowed to run.
Implementations can only crudely filter based on the type of code in the target process, and handlers also will run while the UI thread is blocked waiting for the engine to return. For these reasons, is is often better to listen for the RuntimeInstanceLoad event instead.
Implementations of this interface may restrict when they are called using a filter defined in their component configuration. The following properties may be used: BaseDebugMonitorId, EngineId, TransportKind.
public interface class IDkmProcessCreateNotificationpublic interface class IDkmProcessCreateNotification__interface IDkmProcessCreateNotificationpublic interface IDkmProcessCreateNotificationtype IDkmProcessCreateNotification = interfacePublic Interface IDkmProcessCreateNotificationMethods
| OnProcessCreate(DkmProcess, DkmWorkList, DkmEventDescriptor) |
OnProcessCreate is invoked as part of event processing. See interface definition for more information. |