我即将撰写以下互动：
When there is a process about to start,driver will notify user app and then it will wait for response from the app.
The app will decide whether or not to allow that process to be created normally or terminated immediately,and send
its decision back to the driver.Base on the decision from user app. The driver will then allow or block the process execution.
我的问题是：从驱动程序通知用户模式应用程序然后让驱动程序等待响应的建议方法是什么？
对于事件通知,您可以使用通知事件.即内核调用IoCreateNotificationEvent和KeSetEvent.用户调用KeWaitForSingleObject.对于用户内核消息通信,您可以使用IOCTL.
或者,您可以只使用命名管道.
附：您不能将PsSetCreateProcessnotifyRoutine()用于您的目的,因为它仅用于审核,但不用于预防/取消.