Find centralized, trusted content and collaborate around the technologies you use most.
Teams
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
驱动程序是否可以在内核中为每个上下文切换注册回调?
谢谢!
不,上下文切换发生得太频繁了。有一些 API 可以让您自己注册以获取线程/进程创建/终止的通知(PsSetCreateProcessNotifyRoutine 等)。也许这会有所帮助?