VOID DumpTeardown( VOID ) { (VOID) KeDeregisterBugCheckReasonCallback(&DumpBugCheckReasonCallbackRecord); }
NTSTATUS RemoveCallbackNotify(PVOID InBuffer) { NTSTATUS Status = STATUS_SUCCESS; PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer; ULONG_PTR CallbackAddress = Temp->CallbackAddress; CALLBACK_TYPE CallBackType = Temp->NotifyType; if (!CallbackAddress || !MmIsAddressValid((PVOID)CallbackAddress)) { return STATUS_UNSUCCESSFUL; } DbgPrint("CallBackType: %d\r\n",CallBackType); switch(CallBackType) { case NotifyLoadImage: { DbgPrint("Remove NotifyLoadImage\r\n"); Status = PsRemoveLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)CallbackAddress); break; } case NotifyCmCallBack: { LARGE_INTEGER Cookie; ULONG_PTR Note = Temp->Note; Cookie.QuadPart = 0; DbgPrint("Remove NotifyCmCallBack\r\n"); if (WinVersion == WINDOWS_XP) { Cookie = XpGetRegisterCallbackCookie(Note); } if (WinVersion==WINDOWS_7) { Cookie.QuadPart = Note; } if (Cookie.LowPart == 0 && Cookie.HighPart == 0) { return STATUS_UNSUCCESSFUL; } Status = CmUnRegisterCallback(Cookie); break; } case NotifyKeBugCheckReason: { PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer; ULONG_PTR Note = Temp->Note; if (Note!=NULL&&MmIsAddressValid((PVOID)Note)) { KeDeregisterBugCheckReasonCallback((PKBUGCHECK_REASON_CALLBACK_RECORD)Note); } break; } case NotifyShutdown: { LARGE_INTEGER Cookie; PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer; ULONG_PTR Note = Temp->Note; if (Note!=NULL&&MmIsAddressValid((PVOID)Note)) { IoUnregisterShutdownNotification((PDEVICE_OBJECT)Note); } break; } case NotifyCreateThread: { NTSTATUS Status = STATUS_SUCCESS; PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer; ULONG_PTR CallbackAddress = Temp->CallbackAddress; if (!CallbackAddress || !MmIsAddressValid((PVOID)CallbackAddress)||!PsRemoveCreateThreadNotifyRoutine) { return STATUS_UNSUCCESSFUL; } Status = PsRemoveCreateThreadNotifyRoutine((PCREATE_THREAD_NOTIFY_ROUTINE)CallbackAddress); break; } default: { Status = STATUS_UNSUCCESSFUL; } } return Status; }