[lorddoskias]

How can I gain insight into what chain of event (that is what functions) are called when a particular event happens e.g. a process is killed from the process explorer. Precisely, how do I know which function should I set a breakpoint on so that the bp gets triggered when a process is killed?

[rkhunter]

If you want to look actually termination of the kernel object _EPROCESS (cleaning address space of specified process and etc.), look PspProcessDelete - destruction method of all processes.

Code: Select all

VOID
PspProcessDelete(
    IN PEPROCESS Object
    )

If you want to look chain of functions that called process termination from user mode, look NtTerminateProcess.