[myid]

Hi, everyone.
We all knows that we can use PsSetCreateProcessNotifyRoutine to create or remove a create process notification.
But I found that some times this function returns falied in WIN10. That is so strange.
Does anyone else have this problem?

[EP_X0FF]

What is the status code?

[tcxyqs]

I think related API is hooked, prevent someone remove specific notification.

[Brock]

Very possible the function is hooked as indicated by tcxyqs, malware has done this to do as he said and that is to prevent the removal of a callback it has installed so it guards it if the 2nd param of the function is set to TRUE (Removal). Anyhow, where are you calling PsSetCreateProcessNotifyRoutine() (in system context i.e> DriverEntry or other?) and what is the 2nd parameter set to, True or False?

[tangptr]

Note that there are three kinds of create process notification callbacks since Windows 10, version 1703. These three kinds of callbacks could be respectively created by PsSetCreateProcessNotifyRoutine, PsSetCreateProcessNotifyRoutineEx, or PsSetCreateProcessNotifyRoutineEx2. Those three kinds of callbacks could ONLY be removed by the function that created them. Maybe you called PsSetCreateProcessNotifyRoutineEx to remove a callback created by PsSetCreateProcessNotifyRoutineEx2. Doing so would certainly cause a failure.

Related Articles:
PsSetCreateProcessNotifyRoutine:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx
PsSetCreateProcessNotifyRoutineEx:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx
PsSetCreateProcessNotifyRoutineEx2:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx

[myid]

Note that there are three kinds of create process notification callbacks since Windows 10, version 1703. These three kinds of callbacks could be respectively created by PsSetCreateProcessNotifyRoutine, PsSetCreateProcessNotifyRoutineEx, or PsSetCreateProcessNotifyRoutineEx2. Those three kinds of callbacks could ONLY be removed by the function that created them. Maybe you called PsSetCreateProcessNotifyRoutineEx to remove a callback created by PsSetCreateProcessNotifyRoutineEx2. Doing so would certainly cause a failure.

Related Articles:
PsSetCreateProcessNotifyRoutine:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx
PsSetCreateProcessNotifyRoutineEx:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx
PsSetCreateProcessNotifyRoutineEx2:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx

Thanks for your very useful information.

[tangptr]

Note that there are three kinds of create process notification callbacks since Windows 10, version 1703. These three kinds of callbacks could be respectively created by PsSetCreateProcessNotifyRoutine, PsSetCreateProcessNotifyRoutineEx, or PsSetCreateProcessNotifyRoutineEx2. Those three kinds of callbacks could ONLY be removed by the function that created them. Maybe you called PsSetCreateProcessNotifyRoutineEx to remove a callback created by PsSetCreateProcessNotifyRoutineEx2. Doing so would certainly cause a failure.

Related Articles:
PsSetCreateProcessNotifyRoutine:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx
PsSetCreateProcessNotifyRoutineEx:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx
PsSetCreateProcessNotifyRoutineEx2:
https://msdn.microsoft.com/en-us/librar ... s.85).aspx

Thanks for your very useful information.

So, have you solved your problem?