// ntddk.h
typedef enum _PSCREATETHREADNOTIFYTYPE {
PsCreateThreadNotifyNonSystem,
PsCreateThreadNotifySubsystems
} PSCREATETHREADNOTIFYTYPE;
View the official Windows Driver Kit DDI referenceNo description available.
Indicates the type of thread notification. This enumeration is used in PsSetCreateThreadNotifyRoutineEx to register callback notifications associated with thread creation or deletion.
PsCreateThreadNotifyNonSystemThe driver-registered callback function is executed on the new non-system thread, which enables the callback function to perform tasks such as setting the initial thread context.
PsCreateThreadNotifySubsystemsIndicates that the driver-registered callback function is invoked for threads of all subsystems. Drivers can call NtQueryInformationThread to determine the underlying subsystem. The query retrieves a SUBSYSTEM_INFORMATION_TYPE value.
PsSetCreateThreadNotifyRoutineEx