PLIST_ENTRY
GetProcCallList()
{
NTSTATUS status;
OB_CALLBACK_REGISTRATION obReg;
OB_OPERATION_REGISTRATION opReg;
PCALLBACK_NODE obHandle;
memset(&obReg, 0, sizeof(obReg));
obReg.Version = ObGetFilterVersion();
obReg.OperationRegistrationCount = 1;
obReg.RegistrationContext = NULL;
RtlInitUnicodeString(&obReg.Altitude, L"CallBack");
memset(&opReg, 0, sizeof(opReg));//Init Struct
opReg.ObjectType = PsProcessType;
opReg.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)&PreCall;
//opReg.PostOperation=(POB_POST_OPERATION_CALLBACK)&PostCall;
obReg.OperationRegistration = &opReg;
status = ObRegisterCallbacks(&obReg, &obHandle);
if(NT_SUCCESS(status)){
PLIST_ENTRY self = &(obHandle->Entries[0].CallbackList);
ObUnRegisterCallbacks((PVOID)obHandle);
return self->Blink;
}
else {
DbgPrint("RegisterCallback failed! errcode:%x", status);
}
return NULL;
}
NTSTATUS
DriverEntry (
_In_ PDRIVER_OBJECT DriverObject,
_In_ PUNICODE_STRING RegistryPath
)
{
NTSTATUS Status;
UNICODE_STRING NtDeviceName = RTL_CONSTANT_STRING (TD_NT_DEVICE_NAME);
UNICODE_STRING DosDevicesLinkName = RTL_CONSTANT_STRING (TD_DOS_DEVICES_LINK_NAME);
PDEVICE_OBJECT Device = NULL;
BOOLEAN SymLinkCreated = FALSE;
USHORT CallbackVersion;
UNREFERENCED_PARAMETER (RegistryPath);
DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "ObCallbackTest: DriverEntry: Driver loaded. Use ed nt!Kd_IHVDRIVER_Mask f (or 7) to enable more traces\n");
CallbackVersion = ObGetFilterVersion();
DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "ObCallbackTest: DriverEntry: Callback version 0x%hx\n", CallbackVersion);
//
// Initialize globals.
//
KeInitializeGuardedMutex (&TdCallbacksMutex);
//
// Create our device object.
//
Status = IoCreateDevice (
DriverObject, // pointer to driver object
0, // device extension size
&NtDeviceName, // device name
FILE_DEVICE_UNKNOWN, // device type
0, // device characteristics
FALSE, // not exclusive
&Device); // returned device object pointer
if (! NT_SUCCESS(Status))
{
goto Exit;
}
TD_ASSERT (Device == DriverObject->DeviceObject);
//
// Set dispatch routines.
//
DriverObject->MajorFunction[IRP_MJ_CREATE] = TdDeviceCreate;
DriverObject->MajorFunction[IRP_MJ_CLOSE] = TdDeviceClose;
DriverObject->MajorFunction[IRP_MJ_CLEANUP] = TdDeviceCleanup;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = TdDeviceControl;
DriverObject->DriverUnload = TdDeviceUnload;
//
// Create a link in the Win32 namespace.
//
Status = IoCreateSymbolicLink (&DosDevicesLinkName, &NtDeviceName);
if (! NT_SUCCESS(Status))
{
goto Exit;
}
SymLinkCreated = TRUE;
//
// Set process create routines.
//
Status = PsSetCreateProcessNotifyRoutineEx (
TdCreateProcessNotifyRoutine2,
FALSE
);
if (! NT_SUCCESS(Status))
{
DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "ObCallbackTest: DriverEntry: PsSetCreateProcessNotifyRoutineEx(2) returned 0x%x\n", Status);
goto Exit;
}
TdProcessNotifyRoutineSet2 = TRUE;
Exit:
if (!NT_SUCCESS (Status))
{
if (TdProcessNotifyRoutineSet2 == TRUE)
{
Status = PsSetCreateProcessNotifyRoutineEx (
TdCreateProcessNotifyRoutine2,
TRUE
);
TD_ASSERT (Status == STATUS_SUCCESS);
TdProcessNotifyRoutineSet2 = FALSE;
}
if (SymLinkCreated == TRUE)
{
IoDeleteSymbolicLink (&DosDevicesLinkName);
}
if (Device != NULL)
{
IoDeleteDevice (Device);
}
}
return Status;
}
