| 34 | } |
| 35 | |
| 36 | NTSTATUS ObCallbacks::SetupCallbacks( |
| 37 | OPTIONAL OB_PREOP_CALLBACK_STATUS(NTAPI *PreCallback)( |
| 38 | PVOID RegistrationContext, |
| 39 | POB_PRE_OPERATION_INFORMATION OperationInformation |
| 40 | ), |
| 41 | OPTIONAL VOID (NTAPI *PostCallback)( |
| 42 | PVOID RegistrationContext, |
| 43 | POB_POST_OPERATION_INFORMATION OperationInformation |
| 44 | ), |
| 45 | OPTIONAL PVOID RegistrationContext, |
| 46 | ObCallbackType CallbackType, |
| 47 | OB_OPERATION OperationType |
| 48 | ) { |
| 49 | if (RegistrationHandle) RemoveCallbacks(); |
| 50 | |
| 51 | if (!DynObRegisterCallbacks || !DynObUnRegisterCallbacks) |
| 52 | return STATUS_NOT_SUPPORTED; |
| 53 | |
| 54 | if ((CallbackType == (ctProcesses | ctThreads)) || (CallbackType == ctMaxValue)) |
| 55 | CallbackType = ctAll; |
| 56 | |
| 57 | if (!PreCallback && !PostCallback) |
| 58 | return STATUS_INVALID_PARAMETER; |
| 59 | |
| 60 | OB_OPERATION_REGISTRATION Operations[ctMaxValue - 1] = {}; |
| 61 | |
| 62 | Operations[ctProcesses - 1].ObjectType = PsProcessType; |
| 63 | Operations[ctProcesses - 1].Operations = OperationType; |
| 64 | Operations[ctProcesses - 1].PreOperation = PreCallback; |
| 65 | Operations[ctProcesses - 1].PostOperation = PostCallback; |
| 66 | |
| 67 | Operations[ctThreads - 1].ObjectType = PsThreadType; |
| 68 | Operations[ctThreads - 1].Operations = OperationType; |
| 69 | Operations[ctThreads - 1].PreOperation = PreCallback; |
| 70 | Operations[ctThreads - 1].PostOperation = PostCallback; |
| 71 | |
| 72 | OB_CALLBACK_REGISTRATION Registration = {}; |
| 73 | Registration.Version = OB_FLT_REGISTRATION_VERSION; |
| 74 | Registration.OperationRegistrationCount = CallbackType == ctAll |
| 75 | ? sizeof(Operations) / sizeof(*Operations) |
| 76 | : 1; |
| 77 | RtlInitUnicodeString(&Registration.Altitude, L"389020"); |
| 78 | Registration.RegistrationContext = RegistrationContext; |
| 79 | Registration.OperationRegistration = CallbackType == ctAll |
| 80 | ? reinterpret_cast<POB_OPERATION_REGISTRATION>(&Operations) |
| 81 | : reinterpret_cast<POB_OPERATION_REGISTRATION>(&Operations[CallbackType - 1]); |
| 82 | |
| 83 | return DynObRegisterCallbacks(&Registration, &RegistrationHandle); |
| 84 | } |
| 85 | |
| 86 | VOID ObCallbacks::RemoveCallbacks() { |
| 87 | if (RegistrationHandle) |
no outgoing calls
no test coverage detected