Hi,
I know that to receive notifications about win32 process creation or termination we might implement a NT kernel-mode driver using the APIs PsSetCreateProcessNotifyRoutine() that offers the ability to register system-wide callback function which is called by OS each time when a new process starts, exits or is terminated.
My question is if this is possible without creating a NT kernel-mode driver, only using win32 api functions using c++? Not using the basic solution of a infinite cycle querying the list of active process of course.
Is there any library or win32 API that provides the same functionality (system wide callback, asynchronous events, ...)?
Thanks