A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #27906  by jakeman8888
 Fri Feb 19, 2016 11:27 pm
Hi,

To remove thread creation callbacks, do you have to find the registered callbacks in the array of callback entry items? Or is there a better way to achieve this? I've been trying to think of the proper way to approach this.

Thanks.