| 557 | } |
| 558 | |
| 559 | bool EnumObCallbackNotify(POBJECT_TYPE objectType,ULONG callbackListOffset,ObCallbackInfo* info) { |
| 560 | PLIST_ENTRY callbackListHead = nullptr; |
| 561 | PLIST_ENTRY nextEntry = nullptr; |
| 562 | POB_CALLBACK_ENTRY callbackEntry = nullptr; |
| 563 | ULONG count = 0; |
| 564 | |
| 565 | if (!objectType) { |
| 566 | return false; |
| 567 | } |
| 568 | |
| 569 | callbackListHead = (PLIST_ENTRY)((PUCHAR)objectType + callbackListOffset); |
| 570 | nextEntry = callbackListHead->Flink; |
| 571 | int i = 0; |
| 572 | while (nextEntry != callbackListHead) { |
| 573 | callbackEntry = CONTAINING_RECORD(nextEntry, OB_CALLBACK_ENTRY, EntryItemList); |
| 574 | if (ExAcquireRundownProtection(&callbackEntry->RundownProtect)) { |
| 575 | LogInfo("PreOperation %p, PostOperation: %p\n", callbackEntry->PreOperation, callbackEntry->PostOperation); |
| 576 | if (FlagOn(callbackEntry->Operations, OB_OPERATION_HANDLE_CREATE)) |
| 577 | LogInfo("Protect handle from creating\n"); |
| 578 | if (FlagOn(callbackEntry->Operations, OB_OPERATION_HANDLE_DUPLICATE)) |
| 579 | LogInfo("Protect handle from duplicating\n"); |
| 580 | |
| 581 | info[i].PostOperation = callbackEntry->PostOperation; |
| 582 | info[i].PreOperation = callbackEntry->PreOperation; |
| 583 | info[i].RegistrationHandle = callbackEntry->RegistrationHandle; |
| 584 | i++; |
| 585 | ExReleaseRundownProtection(&callbackEntry->RundownProtect); |
| 586 | } |
| 587 | nextEntry = nextEntry->Flink; |
| 588 | } |
| 589 | |
| 590 | return true; |
| 591 | } |
| 592 | |
| 593 | LONG GetObCallbackCount(POBJECT_TYPE objectType, ULONG callbackListOffset) { |
| 594 | PLIST_ENTRY callbackListHead = nullptr; |
no test coverage detected