Knowing about Process creation and termination

NTFSD
1

Hi All,

Could anyone tell me how to get notified when a process is created or
terminated. Can we do this from user mode.

Thanks,
Kedar.

Easiest Money Transfer to India. Send Money To 6000 Indian Towns.
http://go.msnserver.com/IN/42198.asp Easiest Way To Send Money Home!

2

PsSetCreateProcessNotifyRoutine

This is in kernel mode, IIRC no ways from user mode.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “kedar n”
To: “Windows File Systems Devs Interest List”
Sent: Friday, March 12, 2004 12:40 PM
Subject: [ntfsd] Knowing about Process creation and termination

> Hi All,
>
> Could anyone tell me how to get notified when a process is created or
> terminated. Can we do this from user mode.
>
> Thanks,
> Kedar.
>
> _________________________________________________________________
> Easiest Money Transfer to India. Send Money To 6000 Indian Towns.
> http://go.msnserver.com/IN/42198.asp Easiest Way To Send Money Home!
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

From kernel mode, use PsSetCreateProcessNotifyRoutine.
I don’t know any possibility in user mode; however -
you can establist a connection between our driver
and your usermode program.

L.