ObRegisterCallbacks pre- and postoperations call context

Freedom Sy 26 Reputation points
2023-03-11T21:21:00.7+00:00

For both operations the documentation says "This routine is called at PASSIVE_LEVEL in an arbitrary thread context with normal kernel APCs disabled."

I always thought they would be called from the calling process. My code also works as intended.

https://stackoverflow.com/questions/62389142/how-to-find-out-which-process-sent-the-request also confirms this.

Is this a documentation error?

If not, does that mean that PsGetCurrentProcess() does not return the requestor process?

Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,541 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 43,926 Reputation points
    2023-03-14T09:09:27.9033333+00:00

    Hello there,

    In this callback, the current context is the operation requester.

    You can always just call PsGetCurrentProcess and PsGetCurrentProcessId to get the PEPROCESS and Id of the current context.

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer--