2 out of 3 rated this helpful - Rate this topic

ObRegisterCallbacks routine

The ObRegisterCallbacks routine registers a list of callback routines for thread and process handle operations.

Syntax


NTSTATUS ObRegisterCallbacks(
  _In_   POB_CALLBACK_REGISTRATION CallBackRegistration,
  _Out_  PVOID *RegistrationHandle
);

Parameters

CallBackRegistration [in]: A pointer to an OB_CALLBACK_REGISTRATION structure that specifies the list of callback routines and other registration information.
RegistrationHandle [out]: A pointer to a variable that receives a value that identifies the set of registered callback routines. The caller passes this value to the ObUnRegisterCallbacks routine to unregister the set of callbacks.

Return value

ObRegisterCallbacks returns an NTSTATUS value. This routine might return one of the following values:

Return code	Description
STATUS_SUCCESS	The specified callback routines are registered with the system.
STATUS_FLT_INSTANCE_ALTITUDE_COLLISION	The calling driver or another driver has already registered callback routines for the altitude that CallBackRegistration->Altitude specifies. For more information about this altitude, see the Altitude member of the OB_CALLBACK_REGISTRATION structure.
STATUS_INVALID_PARAMETER	One or more of the parameters that were specified in the registration was invalid. ObRegisterCallbacks might return this error, for example, if an invalid value for CallBackRegistration->Version is specified or if registration is attempted for object types that do not support callback routines.
STATUS_ACCESS_DENIED	The callback routines do not reside in a signed kernel binary image.
STATUS_INSUFFICIENT_RESOURCES	An attempt to allocate memory failed.

Remarks

A driver must unregister all callback routines before it unloads. You can unregister the callback routine by calling the ObUnRegisterCallbacks routine.

Requirements