OB_CALLBACK_REGISTRATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// wdm.h
typedef struct _OB_CALLBACK_REGISTRATION {
USHORT Version;
USHORT OperationRegistrationCount;
UNICODE_STRING Altitude;
PVOID RegistrationContext;
OB_OPERATION_REGISTRATION *OperationRegistration;
} OB_CALLBACK_REGISTRATION, *POB_CALLBACK_REGISTRATION;
View the official Windows Driver Kit DDI referenceNo description available.
The OB_CALLBACK_REGISTRATION structure specifies the parameters when the ObRegisterCallbacks routine registers ObjectPreCallback and ObjectPostCallback callback routines.
VersionThe version of object callback registration that is requested. Drivers should specify OB_FLT_REGISTRATION_VERSION.
OperationRegistrationCountThe number of entries in the OperationRegistration array.
AltitudeA Unicode string that specifies the altitude of the driver. For more information about altitude, see Load Order Groups and Altitudes for Minifilter Drivers.
RegistrationContextThe system passes the RegistrationContext value to the callback routine when the callback routine is run. The meaning of this value is driver-defined.
OperationRegistrationA pointer to an array of OB_OPERATION_REGISTRATION structures. Each structure specifies ObjectPreCallback and ObjectPostCallback callback routines and the types of operations that the routines are called for.
This structure is used by the ObRegisterCallbacks routine. The CallBackRegistration parameter to this routine is a pointer to a buffer that contains an OB_CALLBACK_REGISTRATION structure that is followed by an array of one or more OB_OPERATION_REGISTRATION structures.