ObRegisterCallbacks function

The ObRegisterCallbacks routine registers a list of callback routines for thread, process, and desktop handle operations.

Syntax

NTKERNELAPI NTSTATUS ObRegisterCallbacks(
  POB_CALLBACK_REGISTRATION CallbackRegistration,
  PVOID                     *RegistrationHandle
);

Parameters

CallbackRegistration

A pointer to an OB_CALLBACK_REGISTRATION structure that specifies the list of callback routines and other registration information.

RegistrationHandle

A pointer to a variable that receives a value that identifies the set of registered callback routines. The caller passes this value to the ObUnRegisterCallbacks routine to unregister the set of callbacks.

Return Value

ObRegisterCallbacks returns an NTSTATUS value. This routine might return one of the following values:

Return code Description
STATUS_SUCCESS
The specified callback routines are registered with the system.
STATUS_FLT_INSTANCE_ALTITUDE_COLLISION
The calling driver or another driver has already registered callback routines for the altitude that CallBackRegistration->Altitude specifies. For more information about this altitude, see the description of the Altitude member in OB_CALLBACK_REGISTRATION.
STATUS_INVALID_PARAMETER
One or more of the parameters that were specified in the registration was invalid. ObRegisterCallbacks might return this error, for example, if an invalid value for CallBackRegistration->Version is specified or if registration is attempted for object types that do not support callback routines.
STATUS_ACCESS_DENIED
The callback routines do not reside in a signed kernel binary image.
STATUS_INSUFFICIENT_RESOURCES
An attempt to allocate memory failed.

Remarks

A driver must unregister all callback routines before it unloads. You can unregister the callback routine by calling the ObUnRegisterCallbacks routine.

Requirements

   
Minimum supported client Available starting with Windows Vista with Service Pack 1 (SP1) and Windows Server 2008.
Target Platform Universal
Header wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)
Library NtosKrnl.lib
DLL NtosKrnl.exe
IRQL "<= APC_LEVEL"

See Also

OB_CALLBACK_REGISTRATION

ObUnRegisterCallbacks