Home/ Questions/Q 1031757
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T13:58:49+00:00

I know that to receive notifications about Win32 process creation or termination we might

  • 0

I know that to receive notifications about Win32 process creation or termination we might implement a NT kernel-mode driver using the APIs PsSetCreateProcessNotifyRoutine() that offers the ability to register system-wide callback function which is called by OS each time when a new process starts, exits or is terminated.

Is this possible without creating a NT kernel-mode driver, only using Win32 API functions using c++? Not using the basic solution of a infinite cycle querying the list of active process of course.

Is there any library or win32 API that provides the same functionality (system wide callback, asynchronous events)?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The only thing I could think of is WMI, not sure if it provides a process creation callback, but it might be worth looking into.

    • 0