Monitoring Process Creation via the Kernel (Part III)
12/13/2015
The previous two blog posts discussed why BlockBlock required processes creation notifications, and showed several ways to achieve this via a kernel extension. Today, let's conclude this blog mini-series by describing one way to get this ‘process creation information' from the kernel to a user-mode application.
The starting point for this
Read more
Tags: monitoring, Processes, Information, user, Kernel, series, Blog, Blog Posts, extension, application, Notifications, Process, and