ObRegisterCallbacks function (wdm.h)

Article
02/25/2022

The ObRegisterCallbacks routine registers a list of callback routines for thread, process, and desktop handle operations.

Syntax

NTSTATUS ObRegisterCallbacks(
  [in]  POB_CALLBACK_REGISTRATION CallbackRegistration,
  [out] PVOID                     *RegistrationHandle
);

Parameters

[in] CallbackRegistration

A pointer to an OB_CALLBACK_REGISTRATION structure that specifies the list of callback routines and other registration information.

[out] RegistrationHandle

A pointer to a variable that receives a value that identifies the set of registered callback routines. The caller passes this value to the ObUnRegisterCallbacks routine to unregister the set of callbacks.

Return value

ObRegisterCallbacks returns an NTSTATUS value. This routine might return one of the following values:

Return code	Description
STATUS_SUCCESS	The specified callback routines are registered with the system.
STATUS_FLT_INSTANCE_ALTITUDE_COLLISION	The calling driver or another driver has already registered callback routines for the altitude that CallBackRegistration->Altitude specifies. For more information about this altitude, see the description of the Altitude member in OB_CALLBACK_REGISTRATION.
STATUS_INVALID_PARAMETER	One or more of the parameters that were specified in the registration was invalid. ObRegisterCallbacks might return this error, for example, if an invalid value for CallBackRegistration->Version is specified or if registration is attempted for object types that do not support callback routines.
STATUS_ACCESS_DENIED	The callback routines do not reside in a signed kernel binary image.
STATUS_INSUFFICIENT_RESOURCES	An attempt to allocate memory failed.

Remarks

A driver must unregister all callback routines before it unloads. You can unregister the callback routine by calling the ObUnRegisterCallbacks routine.

Requirements

Requirement	Value
Minimum supported client	Available starting with Windows Vista with Service Pack 1 (SP1) and Windows Server 2008.
Target Platform	Universal
Header	wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	<= APC_LEVEL