// ntddk.h
NTSTATUS PsGetProcessExitStatus(
[in] PEPROCESS Process
);
View the official Windows Driver Kit DDI referenceNo description available.
This routine retrieves the exit status of a process.
Process [in]A pointer to the EPROCESS structure that represents the process. Drivers can use the PsGetCurrentProcess and ObReferenceObjectByHandle routines to obtain a pointer to the EPROCESS structure for a process.
Returns the exit status of the supplied EPROCESS.
A driver might call PsGetProcessExitStatus in the following scenarios: monitoring process termination to obtain information about whether a process terminated normally or due to an error, resource cleanup to determine when and how to clean up resources allocated on behalf of a process, and error reporting and logging to provide more detailed information about process terminations.