Process monitoring CreateProcessNotifyRoutineEx
问题 I'm developing a driver for monitoring process creation, I wrote a simple code to do it. I use the PsSetCreateProcessNotifyRoutineEx . But this doesn't work ! I exactly following Microsoft help on this link #include <ntddk.h> NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath ); VOID UnloadRoutine( IN PDRIVER_OBJECT DriverObject ); VOID CreateProcessNotifyEx( __inout PEPROCESS Process, __in HANDLE ProcessId, __in_opt PPS_CREATE_NOTIFY_INFO CreateInfo ); VOID