PsSetCreateProcessNotifyRoutine

Hi,

When my driver receives a notification that a process has been created, is
the process held in a suspended state until the notification handler routine
completes?

Or is the notification asynchronous?

Thanks,
Rich

Don
Thu Apr 06 10:19:26 CDT 2006

The notification occurs as part of the process setup. Actually you are
called before any threads are created (they are created by the thread that
is calling the callbacks later in the process). Now some problems with the
call, the process is not in the process table, so refering to the pid at
this point is not going to work for things like a user space OpenProcess
call. Also, depending on what the parents permissions were and the way
thing are created you may find that the is essentially no permissions on the
process object making it impossible to terminate or do anything useful with
it.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply



"Rich S." <RichS@discussions.microsoft.com> wrote in message
news:86B677EC-F935-45B1-848E-AFB94D908EDE@microsoft.com...
> Hi,
>
> When my driver receives a notification that a process has been created, is
> the process held in a suspended state until the notification handler
> routine
> completes?
>
> Or is the notification asynchronous?
>
> Thanks,
> Rich

RichS
Thu Apr 06 11:18:02 CDT 2006

"Don Burn" wrote:

> The notification occurs as part of the process setup. Actually you are
> called before any threads are created (they are created by the thread that
> is calling the callbacks later in the process). Now some problems with the
> call, the process is not in the process table, so refering to the pid at
> this point is not going to work for things like a user space OpenProcess
> call. Also, depending on what the parents permissions were and the way
> thing are created you may find that the is essentially no permissions on the
> process object making it impossible to terminate or do anything useful with
> it.

Thanks for your reply, Don. Does this mean that this method is a dead end
if I want to be able to inject a DLL into the given process?