RES: Re:When to change ETHREAD Win32StartAddress?

No, it doesn’t.

Only in Windows 2000 or later.

s,
Fernando.

-----Mensagem original-----
De: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] Em nome de td34qz
Enviada em: sexta-feira, 9 de fevereiro de 2007 15:36
Para: Windows File Systems Devs Interest List
Assunto: Re: Re:[ntfsd] When to change ETHREAD Win32StartAddress?

The normal sequence when a process is created (undocumented
implementation details, beware changes in future Windows releases
without warning):

Hey, this is my first trip to kernel land! Will take a while until I get
that.
Anyway that’s exactly what I want, no patching/hooking at all,
preferable
some documented way which unfortunately doesn’t seem to exist :frowning:

Fernando, is PsSetLoadImageNotifyRoutine available in NT?


Arno Garrels


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com