Re: PsSetCreateProcessNotifyRoutine

Tech-Archive recommends: Fix windows errors by optimizing your registry


Hi Don

it looks like they may have eliminated the 8 callback limit in Windows Server 2003 >but I still need to verify this.

This seems to be really good news. In general, imposing limitations on
number of ANY callbacks or filters makes "law-abiding and responsible"
developers (i.e. the ones who follow MS guidelines) worry about
something that is of primary concern to anyone who relies upon
"unsupported" things, i.e. about conflict with third-party software -
your code may work perfectly well on the machine X and fail on the
machine Y, even if both machines run exactly the same flavour of
Windows. As a result, people may want to go for "unsupported"
solutions. It may sound ridiculous, but sometimes "unsupported"
solutions are more stable and reliable than "supported" ones.


In other words, MSFT sometimes just discourages developers from
following its own guidelines......

Anton Bassov



Don Burn wrote:
Anton,

I looked at the kernel source, and there is no way unless a non-zero
value is provided that the error code can occur. Also, it looks like they
may have eliminated the 8 callback limit in Windows Server 2003, but I still
need to verify this.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply



"anton bassov" <soviet_bloke@xxxxxxxxxxx> wrote in message
news:1154217258.974958.183840@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi Don

If the OP pasted his actual code, then FALSE is hardcoded.... At the
same time, I don't see any reason for STATUS_PROCEDURE_NOT_FOUND,
apart from the one you have provided

Anton Bassov

Don Burn wrote:
Debug the code and check the FALSE value you are using, the only way you
will get STATUS_PROCEDURE_NOT_FOUND is if second parameter is non-zero.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply



<euacela@xxxxxxxxx> wrote in message
news:1154212320.263897.236870@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Yes I kn ow this but the error the should be
STATUS_INVALID_PARAMETER
The given NotifyRoutine has already been registered so this is a
redundant call, or the system has reached its limit for registering
process-creation callbacks.
Anyway you might be right because I don't see why it shouldn't work
I saw somewhere on the microsoft website that the device extension
should contain the values of: ProcessId,ParentId and Create but I think
that this is absurd

anton bassov wrote:
Hi mate

Don't forget that the number of process-creation callbacks that can be
registered with the system is limited to 8. Therefore, these is a good
chance that this quota has already been filled by some third-party
drivers

Anton Bassov

euacela@xxxxxxxxx wrote:
I am trying to make something similar to task manager but when I
call
PsSetCreateProcessNotifyRoutine it returns this error: The specified
procedure could not be found.
It means that it's first parameter, the one which should have been
the
pointer to a procedure for callback is not recognised.
I have my callback defined like this:
VOID ProcMgrGabi(IN HANDLE ParentId, IN HANDLE ProcessId,BOOL
Create)
{

etc etc etc;
}
and I call the function like this:
rc=PsSetCreateProcessNotifyRoutine(ProcMgrGabi,FALSE);
and rc returns that error
what can it be



.

Relevant Pages

  • Re: did minix can simulate in windows? -- its entirely possible....
    ... to achieve windows binary compatibility you would need to: ... other other required kernel level / userland tools (pretty much the ... ect) you could even go as far as to integrate callbacks on ... the minix side of things to provide support for the WDM (windows driver ...
    (comp.os.minix)
  • Re: PsSetCreateProcessNotifyRoutine
    ... Anton Bassov ... may have eliminated the 8 callback limit in Windows Server 2003, ... Don Burn ... process-creation callbacks. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: [9fans] critique of sockets API
    ... Originally they were used to allow applications to do asynchronous I/O on earlier Windows incarnations that had no concept of threading. ... Callbacks survived the introduction of threading. ... My point was that as of some time ago, more than a decade I believe, Windows began offering all three options which may be used on their own or in tandem. ... Processing of sporadic network events, e.g. reports from a network resource, is done in auxiliary message queues. ...
    (comp.os.plan9)
  • Re: VW 7.5 behavior while dragging a window on Windows XP
    ... the VW windows while dragging another VW window? ... So being able to respond to WM_PAINT messages means completely reimpleenting the VM/VI event interface to be in terms of callbacks. ... [Callbacks can happen in primitives that do C callouts or in the primitive that exists to accept callbacks, ...
    (comp.lang.smalltalk)