POB_PRE_OPERATION_CALLBACK callback function (wdm.h)

Article
02/22/2024

The ObjectPreCallback routine is called by the operating system when a process or thread handle operation occurs.

Warning

The actions that you can perform in this callback are restricted for safe calls. For more info, see Windows Kernel-Mode Process and Thread Manager.

Syntax

POB_PRE_OPERATION_CALLBACK PobPreOperationCallback;

OB_PREOP_CALLBACK_STATUS PobPreOperationCallback(
  [in] PVOID RegistrationContext,
  [in] POB_PRE_OPERATION_INFORMATION OperationInformation
)
{...}

Parameters

[in] RegistrationContext

The context that the driver specifies as the CallBackRegistration->RegistrationContext parameter of the ObRegisterCallbacks routine. The meaning of this value is driver-defined.

[in] OperationInformation

A pointer to an OB_PRE_OPERATION_INFORMATION structure that specifies the parameters of the handle operation.

Return value

ObjectPreCallback returns an OB_PREOP_CALLBACK_STATUS value. Drivers must return OB_PREOP_SUCCESS.

Remarks

Use the ObRegisterCallbacks routine to register an ObjectPreCallback routine, and use the ObUnRegisterCallbacks routine to unregister the routine.

This routine is called at PASSIVE_LEVEL in an arbitrary thread context with normal kernel APCs disabled. Special kernel APCs are not disabled. For more information about APCs, see Types of APCs.

Requirements

Requirement	Value
Minimum supported client	Available starting with Windows Server 2008.
Target Platform	Desktop
Header	wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)
IRQL	Called at PASSIVE_LEVEL (see Remarks section).