VOID
DumpTeardown(
VOID
)
{
(VOID) KeDeregisterBugCheckReasonCallback(&DumpBugCheckReasonCallbackRecord);
}
NTSTATUS RemoveCallbackNotify(PVOID InBuffer)
{
NTSTATUS Status = STATUS_SUCCESS;
PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer;
ULONG_PTR CallbackAddress = Temp->CallbackAddress;
CALLBACK_TYPE CallBackType = Temp->NotifyType;
if (!CallbackAddress ||
!MmIsAddressValid((PVOID)CallbackAddress))
{
return STATUS_UNSUCCESSFUL;
}
DbgPrint("CallBackType: %d\r\n",CallBackType);
switch(CallBackType)
{
case NotifyLoadImage:
{
DbgPrint("Remove NotifyLoadImage\r\n");
Status = PsRemoveLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)CallbackAddress);
break;
}
case NotifyCmCallBack:
{
LARGE_INTEGER Cookie;
ULONG_PTR Note = Temp->Note;
Cookie.QuadPart = 0;
DbgPrint("Remove NotifyCmCallBack\r\n");
if (WinVersion == WINDOWS_XP)
{
Cookie = XpGetRegisterCallbackCookie(Note);
}
if (WinVersion==WINDOWS_7)
{
Cookie.QuadPart = Note;
}
if (Cookie.LowPart == 0 && Cookie.HighPart == 0)
{
return STATUS_UNSUCCESSFUL;
}
Status = CmUnRegisterCallback(Cookie);
break;
}
case NotifyKeBugCheckReason:
{
PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer;
ULONG_PTR Note = Temp->Note;
if (Note!=NULL&&MmIsAddressValid((PVOID)Note))
{
KeDeregisterBugCheckReasonCallback((PKBUGCHECK_REASON_CALLBACK_RECORD)Note);
}
break;
}
case NotifyShutdown:
{
LARGE_INTEGER Cookie;
PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer;
ULONG_PTR Note = Temp->Note;
if (Note!=NULL&&MmIsAddressValid((PVOID)Note))
{
IoUnregisterShutdownNotification((PDEVICE_OBJECT)Note);
}
break;
}
case NotifyCreateThread:
{
NTSTATUS Status = STATUS_SUCCESS;
PREMOVE_CALLBACK Temp = (PREMOVE_CALLBACK)InBuffer;
ULONG_PTR CallbackAddress = Temp->CallbackAddress;
if (!CallbackAddress ||
!MmIsAddressValid((PVOID)CallbackAddress)||!PsRemoveCreateThreadNotifyRoutine)
{
return STATUS_UNSUCCESSFUL;
}
Status = PsRemoveCreateThreadNotifyRoutine((PCREATE_THREAD_NOTIFY_ROUTINE)CallbackAddress);
break;
}
default:
{
Status = STATUS_UNSUCCESSFUL;
}
}
return Status;
}
