|
|
新增的函数是：PsSetCreateThreadNotifyRoutineEx。这个函数比老函数（PsSetCreateThreadNotifyRoutine）有了一些实质性的进步，可以选择性接收特定类型线程的消息（可以指定只接收非系统线程的通知，而忽略系统线程的通知）。而最大变化是：If NotifyType is PsCreateThreadNotifyNonSystem, the PsSetCreateThreadNotifyRoutineEx routine differs from PsSetCreateThreadNotifyRoutine in the context in which the callback is executed. With PsSetCreateThreadNotifyRoutine, the callback is executed on the creator thread. With PsSetCreateThreadNotifyRoutineEx, the callback is executed on the newly created thread. |
|
发表于 2017-11-14 21:51:20
发表于 2017-11-14 22:01:52
