The ObRegisterCallbacks routine registers a list of callback routines for thread, process, and desktop handle operations.
NTKERNELAPI NTSTATUS ObRegisterCallbacks( POB_CALLBACK_REGISTRATION CallbackRegistration, PVOID *RegistrationHandle );
A pointer to an OB_CALLBACK_REGISTRATION structure that specifies the list of callback routines and other registration information.
A pointer to a variable that receives a value that identifies the set of registered callback routines. The caller passes this value to the ObUnRegisterCallbacks routine to unregister the set of callbacks.
ObRegisterCallbacks returns an NTSTATUS value. This routine might return one of the following values:
||The specified callback routines are registered with the system.|
||The calling driver or another driver has already registered callback routines for the altitude that CallBackRegistration->Altitude specifies. For more information about this altitude, see the description of the Altitude member in OB_CALLBACK_REGISTRATION.|
||One or more of the parameters that were specified in the registration was invalid. ObRegisterCallbacks might return this error, for example, if an invalid value for CallBackRegistration->Version is specified or if registration is attempted for object types that do not support callback routines.|
||The callback routines do not reside in a signed kernel binary image.|
||An attempt to allocate memory failed.|
A driver must unregister all callback routines before it unloads. You can unregister the callback routine by calling the ObUnRegisterCallbacks routine.
|Windows version||Available starting with Windows Vista with Service Pack 1 (SP1) and Windows Server 2008.|
|Header||wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)|