POB_POST_OPERATION_CALLBACK callback function (wdm.h)
The ObjectPostCallback routine is called by the operating system after a process or thread handle operation occurs.
Warning
The actions that you can perform in this callback are restricted for safe calls. For more info, see Windows Kernel-Mode Process and Thread Manager.
Syntax
POB_POST_OPERATION_CALLBACK PobPostOperationCallback;
void PobPostOperationCallback(
[in] PVOID RegistrationContext,
[in] POB_POST_OPERATION_INFORMATION OperationInformation
)
{...}
Parameters
[in] RegistrationContext
The context that the driver specifies as the CallBackRegistration->RegistrationContext parameter of the ObRegisterCallbacks routine. The meaning of this value is driver-defined.
[in] OperationInformation
A pointer to an OB_POST_OPERATION_INFORMATION structure that specifies the parameters of the handle operation.
Return value
None
Remarks
Use the ObRegisterCallbacks routine to register an ObjectPostCallback routine, and use the ObUnRegisterCallbacks routine to unregister the routine.
An ObjectPostCallback routine is called after an operation on a process handle or thread handle completes, whereas an ObjectPreCallback routine is called before the operation occurs. The OperationInformation parameter of the ObjectPreCallback routine is a pointer to an OB_PRE_OPERATION_INFORMATION structure, which contains information that you can modify. In contrast, the OperationInformation parameter of the ObjectPostCallback routine is a pointer to an OB_POST_OPERATION_INFORMATION structure. The contents of this structure are informational and you cannot modify them.
This routine is called at PASSIVE_LEVEL in an arbitrary thread context with normal kernel APCs disabled. Special kernel APCs are not disabled. For more information about APCs, see Types of APCs.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Available starting with Windows Server 2008. |
| Target Platform | Desktop |
| Header | wdm.h (include Wdm.h, Ntddk.h, Ntifs.h) |
| IRQL | Called at PASSIVE_LEVEL (see Remarks section). |