I am trying to create a process scaning application for my company use.
I've found using PsSetCreateProcessNotifyRoutine/PsSetLoadImageNotifyRoutine callbacks are useful for this purpose. Then, I have a question: Which callback is called first?
I've found the callback of PsSetCreateProcessNotifyRoutine got called first and PsSetLoadImageNotifyRoutine callback was subsquently called for a paticular process.
Can I rely on this finding? The callbacks always behave in this way? MSDN doc says that the callback of PsSetCreateProcessNotifyRoutine gets called after first thread of the process initiates. This does not explain relation ship between other callbacks.
|