Hi, just a minor question so that i am clear on this.
This question relates to the article “What’s in a (Process) Name? …” in
the latest issue of NT Insider. And i want to be sure on this.
AFAIK in the call to ZwQueryProcessInformation as the first parameter you
can send the parameter from the callback registered to
PsSetCreateProcessNotifyRoutine instead of using the NtCurrentProcess macro.
Am i correct (I think so) or am i wrong?
Thanks in Advance.
/Faik