POB_POST_OPERATION_CALLBACK callback function (wdm.h)
The ObjectPostCallback routine is called by the operating system after a process or thread handle operation occurs.
The actions that you can perform in this callback are restricted for safe calls. For more info, see Windows Kernel-Mode Process and Thread Manager.
[in] PVOID RegistrationContext,
[in] POB_POST_OPERATION_INFORMATION OperationInformation
The context that the driver specifies as the CallBackRegistration->RegistrationContext parameter of the ObRegisterCallbacks routine. The meaning of this value is driver-defined.
A pointer to an OB_POST_OPERATION_INFORMATION structure that specifies the parameters of the handle operation.
An ObjectPostCallback routine is called after an operation on a process handle or thread handle completes, whereas an ObjectPreCallback routine is called before the operation occurs. The OperationInformation parameter of the ObjectPreCallback routine is a pointer to an OB_PRE_OPERATION_INFORMATION structure, which contains information that you can modify. In contrast, the OperationInformation parameter of the ObjectPostCallback routine is a pointer to an OB_POST_OPERATION_INFORMATION structure. The contents of this structure are informational and you cannot modify them.
This routine is called at PASSIVE_LEVEL in an arbitrary thread context with normal kernel APCs disabled. Special kernel APCs are not disabled. For more information about APCs, see Types of APCs.
|Minimum supported client
|Available starting with Windows Server 2008.
|wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)
|Called at PASSIVE_LEVEL (see Remarks section).