创建进程回调

#include <ntddk.h>VOID UnloadDriver(PDRIVER_OBJECT pDriver);VOIDCreateProcessRoutineSpy(IN HANDLE  ParentId,IN HANDLE  ProcessId,IN BOOLEAN  Create);NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING Registry){NTSTATUS status = STATUS_SUCCESS;UNREFERENCED_PARAMETER(pDriver);UNREFERENCED_PARAMETER(Registry);KdPrint(("[SysTest] DriverEntry Loading.\n"));status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, FALSE);if (!NT_SUCCESS(status)){KdPrint(("[SysTest] PsSetCreateProcessNotifyRoutine failed status:(%x).\n", status));return status;}pDriver->DriverUnload = UnloadDriver;return status;}VOIDCreateProcessRoutineSpy(IN HANDLE  ParentId,IN HANDLE  ProcessId,IN BOOLEAN  Create){if (Create){KdPrint(("进程创建[SysTest] Process Created. ParentId:(%d) ProcessId:(%d).\n", ParentId, ProcessId));}else{KdPrint(("进程销毁[SysTest] Process Terminated ProcessId:(%d).ParentId:(%d) .\n", ProcessId, ParentId));}return;}VOID UnloadDriver(PDRIVER_OBJECT pDriver){UNREFERENCED_PARAMETER(pDriver);NTSTATUS status;status = PsSetCreateProcessNotifyRoutine(CreateProcessRoutineSpy, TRUE);if (NT_SUCCESS(status)){KdPrint(("卸载完成[SysTest] UnloadDriver.\n"));}return;}