BOOT_DRIVER_CALLBACK_FUNCTION callback function (ntddk.h)
A boot-start driver's BOOT_DRIVER_CALLBACK_FUNCTION routine can monitor boot-start driver initialization events and return data to the kernel to enable the kernel to decide whether to initialize each boot-start driver. The function prototype to register a boot-start driver callback routine is as follows.
Syntax
BOOT_DRIVER_CALLBACK_FUNCTION BootDriverCallbackFunction;
void BootDriverCallbackFunction(
PVOID CallbackContext,
BDCB_CALLBACK_TYPE Classification,
PBDCB_IMAGE_INFORMATION ImageInformation
)
{...}
Parameters
CallbackContext
The value that the driver passed as the CallbackContext parameter to IoRegisterBootDriverCallback when it registered this BOOT_DRIVER_CALLBACK_FUNCTION implementation.
Classification
A BDCB_CALLBACK_TYPE enumeration value that either identifies the status of boot-start driver initialization or indicates that a boot-start driver is about to be initialized.
ImageInformation
A pointer to a BDCB_IMAGE_INFORMATION structure that contains information that is specific to the type of callback. The structure type depends on the value passed for CallbackType, as shown in the following table.
| Value of CallbackType | Corresponding structure to use |
|---|---|
| BdCbStatusUpdate | BDCB_STATUS_UPDATE_TYPE |
| BdCbInitializeImage | BDCB_CLASSIFICATION |
Return value
None
Remarks
To be notified of boot-start driver initialization operations, an early launch anti-malware (ELAM) driver can call IoRegisterBootDriverCallback. To unregister, call IoUnRegisterBootDriverCallback.
Requirements
| Requirement | Value |
|---|---|
| Header | ntddk.h |
| IRQL | PASSIVE_LEVEL |