Cheat Engine

[appalsap]

I am making a type 3 plugin (processwatcher notify event), how would I distinguish between the callback being for process termination or process creation?*

*I don't want to use an internal boolean for this because the plugin could be loaded after a process is created or CE for that matter. I'd rather not be constantly querying the process to see if it dies, because it's time critical. I would understand if that's the only way, though.

[Dark Byte]

there is no way to see that directly. But you can find out if it's created or not.
When a process is created your plugin is called, but it is also called when the process is destroyed.
so if you save the processid and peprocess of a process then you can be sure that the next time you get THAT processid/peprocess combination it's a termination