| 137 | |
| 138 | |
| 139 | void LoadKernelCallbacks() { |
| 140 | NTSTATUS ret; |
| 141 | |
| 142 | // Process |
| 143 | if (g_Settings.init_processnotify) { |
| 144 | ret = PsSetCreateProcessNotifyRoutineEx(CreateProcessNotifyRoutine, FALSE); |
| 145 | if (ret == STATUS_SUCCESS) { |
| 146 | LOG_A(LOG_INFO, "CreateProcessNotifyRoutine launched successfully\n"); |
| 147 | } |
| 148 | else if (ret == STATUS_INVALID_PARAMETER) { |
| 149 | LOG_A(LOG_INFO, "ERROR: CreateProcessNotifyRoutine Invalid parameter\n"); |
| 150 | } |
| 151 | else if (ret == STATUS_ACCESS_DENIED) { |
| 152 | LOG_A(LOG_INFO, "ERROR: CreateProcessNotifyRoutine Access denied\n"); |
| 153 | } |
| 154 | } |
| 155 | |
| 156 | // Thread |
| 157 | if (g_Settings.init_threadnotify) { |
| 158 | ret = PsSetCreateThreadNotifyRoutine(CreateThreadNotifyRoutine); |
| 159 | if (ret == STATUS_SUCCESS) { |
| 160 | LOG_A(LOG_INFO, "CreateThreadNotifyRoutine launched successfully\n"); |
| 161 | } |
| 162 | else if (ret == STATUS_INVALID_PARAMETER) { |
| 163 | LOG_A(LOG_INFO, "ERROR: CreateThreadNotifyRoutine Invalid parameter\n"); |
| 164 | } |
| 165 | else if (ret == STATUS_ACCESS_DENIED) { |
| 166 | LOG_A(LOG_INFO, "ERROR: CreateThreadNotifyRoutine Access denied\n"); |
| 167 | } |
| 168 | } |
| 169 | |
| 170 | // Image |
| 171 | if (g_Settings.init_imagenotify) { |
| 172 | ret = PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine); |
| 173 | if (ret == STATUS_SUCCESS) { |
| 174 | LOG_A(LOG_INFO, "LoadImageNotifyRoutine launched successfully\n"); |
| 175 | } |
| 176 | else if (ret == STATUS_INVALID_PARAMETER) { |
| 177 | LOG_A(LOG_INFO, "ERROR: LoadImageNotifyRoutine Invalid parameter\n"); |
| 178 | } |
| 179 | else if (ret == STATUS_ACCESS_DENIED) { |
| 180 | LOG_A(LOG_INFO, "ERROR: LoadImageNotifyRoutine Access denied\n"); |
| 181 | } |
| 182 | } |
| 183 | |
| 184 | // Open |
| 185 | if (g_Settings.init_obnotify) { |
| 186 | // https://github.com/microsoft/Windows-driver-samples/blob/main/general/obcallback/driver/callback.c |
| 187 | OB_CALLBACK_REGISTRATION CBObRegistration = { 0 }; |
| 188 | UNICODE_STRING CBAltitude = { 0 }; |
| 189 | RtlInitUnicodeString(&CBAltitude, L"1000"); |
| 190 | TD_CALLBACK_REGISTRATION CBCallbackRegistration = { 0 }; |
| 191 | |
| 192 | OB_OPERATION_REGISTRATION CBOperationRegistrations[2] = { { 0 }, { 0 } }; |
| 193 | CBOperationRegistrations[0].ObjectType = PsProcessType; |
| 194 | CBOperationRegistrations[0].Operations |= OB_OPERATION_HANDLE_CREATE; |
| 195 | CBOperationRegistrations[0].Operations |= OB_OPERATION_HANDLE_DUPLICATE; |
| 196 | CBOperationRegistrations[0].PreOperation = CBTdPreOperationCallback; |