POB_PRE_OPERATION_CALLBACK - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// wdm.h
POB_PRE_OPERATION_CALLBACK PobPreOperationCallback;
OB_PREOP_CALLBACK_STATUS PobPreOperationCallback(
[in] PVOID RegistrationContext,
[in] POB_PRE_OPERATION_INFORMATION OperationInformation
)
{...}
View the official Windows Driver Kit DDI referenceNo description available.
The ObjectPreCallback routine is called by the operating system when a process or thread handle operation occurs.
[!WARNING] The actions that you can perform in this callback are restricted for safe calls. For more info, see Windows Kernel-Mode Process and Thread Manager.
RegistrationContext [in]The context that the driver specifies as the CallBackRegistration->RegistrationContext parameter of the ObRegisterCallbacks routine. The meaning of this value is driver-defined.
OperationInformation [in]A pointer to an OB_PRE_OPERATION_INFORMATION structure that specifies the parameters of the handle operation.
ObjectPreCallback returns an OB_PREOP_CALLBACK_STATUS value. Drivers must return OB_PREOP_SUCCESS.
Use the ObRegisterCallbacks routine to register an ObjectPreCallback routine, and use the ObUnRegisterCallbacks routine to unregister the routine.
This routine is called at PASSIVE_LEVEL in an arbitrary thread context with normal kernel APCs disabled. Special kernel APCs are not disabled. For more information about APCs, see Types of APCs.