问题
When you create a DLL you can get notifications about new threads / exiting threads in the DllMain function (DLL_THREAD_ATTACH/DLL_THREAD_DETACH).
Is there a way to get these or equivalent notifications from Windows within an (non managed) Executable?
回答1:
Yes - include a small stub DLL in your process that simply monitors DLL_THREAD_ATTACH and DLL_THREAD_DETACH in the way you want.
来源：https://stackoverflow.com/questions/3628148/get-notifications-of-new-threads-deleted-threads-under-windows