OB_OPERATION_REGISTRATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// wdm.h
typedef struct _OB_OPERATION_REGISTRATION {
POBJECT_TYPE *ObjectType;
OB_OPERATION Operations;
POB_PRE_OPERATION_CALLBACK PreOperation;
POB_POST_OPERATION_CALLBACK PostOperation;
} OB_OPERATION_REGISTRATION, *POB_OPERATION_REGISTRATION;
View the official Windows Driver Kit DDI referenceNo description available.
The OB_OPERATION_REGISTRATION structure specifies ObjectPreCallback and ObjectPostCallback callback routines and the types of operations that the routines are called for.
ObjectTypeA pointer to the object type that triggers the callback routine. Specify one of the following values:
OperationsSpecify one or more of the following flags:
A new process, thread, or desktop handle was or will be opened.
A process, thread, or desktop handle was or will be duplicated.
PreOperationA pointer to an ObjectPreCallback routine. The system calls this routine before the requested operation occurs.
PostOperationA pointer to an ObjectPostCallback routine. The system calls this routine after the requested operation occurs.
This structure is used by the ObRegisterCallbacks routine. The CallBackRegistration parameter to this routine is a pointer to a buffer that contains an OB_CALLBACK_REGISTRATION structure that is followed by an array of one or more OB_OPERATION_REGISTRATION structures.
In each OB_OPERATION_REGISTRATION structure passed to ObRegisterCallback, the caller must supply one or both callback routines. If the PreOperation and PostOperation members of this structure are both NULL, the callback registration operation fails.