PKEVENT
IoCreateNotificationEvent(
IN PUNICODE_STRING EventName,
OUT PHANDLE EventHandle
);
IoCreateNotificationEvent creates or opens a named notification event used to notify one or more threads of execution that an event has occurred. When a notification event is set to the Signaled state it remains in that state until it is explicitly cleared.
IoCreateNotificationEvent returns a pointer to the created or opened event object or NULL if the event object could not be created or opened.
IoCreateNotificationEvent creates and opens the event object if it does not already exist. IoCreateNotificationEvent sets the state of a new notification event to Signaled. If the event object already exists, IoCreateNotificationEvent just opens the event object.
Notification events, like synchronization events, are used to coordinate execution. Unlike a synchronization event, a notification event is not auto-resetting. Once a notification event is in the Signaled state, it remains in that state until it is explicitly reset (with a call to KeClearEvent or KeResetEvent).
To synchronize on a notification event:
Callers of IoCreateNotificationEvent must be running at IRQL PASSIVE_LEVEL.
IoCreateSynchronizationEvent, KeClearEvent, KeResetEvent, KeSetEvent, KeWaitForSingleObject, RtlInitUnicodeString, ZwClose