IRP
MDL
Expand Minimize

OB_OPERATION_REGISTRATION structure

The OB_OPERATION_REGISTRATION structure specifies ObjectPreCallback and ObjectPostCallback callback routines and the types of operations that the routines are called for.

Syntax


typedef struct _OB_OPERATION_REGISTRATION {
  POBJECT_TYPE                *ObjectType;
  OB_OPERATION                Operations;
  POB_PRE_OPERATION_CALLBACK  PreOperation;
  POB_POST_OPERATION_CALLBACK PostOperation;
} OB_OPERATION_REGISTRATION, *POB_OPERATION_REGISTRATION;

Members

ObjectType

A pointer to the object type (process or thread) that triggers the callback routine. Specify either PsProcessType for process handle operations, or PsThreadType for thread handle operations.

Operations

Specify one or more of the following flags:

OB_OPERATION_HANDLE_CREATE

A new process handle or thread handle was or will be opened.

OB_OPERATION_HANDLE_DUPLICATE

A process handle or thread handle was or will be duplicated.

PreOperation

A pointer to an ObjectPreCallback routine. The system calls this routine before the requested operation occurs.

PostOperation

A pointer to an ObjectPostCallback routine. The system calls this routine after the requested operation occurs.

Remarks

This structure is used by the ObRegisterCallbacks routine. The CallBackRegistration parameter to this routine is a pointer to a buffer that contains an OB_CALLBACK_REGISTRATION structure that is followed by an array of one or more OB_OPERATION_REGISTRATION structures.

In each OB_OPERATION_REGISTRATION structure passed to ObRegisterCallback, the caller must supply one or both callback routines. If the PreOperation and PostOperation members of this structure are both NULL, the callback registration operation fails.

Requirements

Version

Available starting with Windows Server 2008.

Header

Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h)

See also

OB_CALLBACK_REGISTRATION
ObjectPostCallback
ObjectPreCallback
ObRegisterCallbacks

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft