Initial publish

9 files changed, 1563 insertions, 0 deletions

diff --git a/general/obcallback/driver/ObCallbackTest.vcxproj b/general/obcallback/driver/ObCallbackTest.vcxproj
new file mode 100644
index 00000000..e781eb3a
--- /dev/null
+++ b/general/obcallback/driver/ObCallbackTest.vcxproj
@@ -0,0 +1,210 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{C696D115-0970-4E9C-8FED-31A99E039ED5}</ProjectGuid>
+    <RootNamespace>$(MSBuildProjectName)</RootNamespace>
+    <Configuration Condition="'$(Configuration)' == ''">Debug</Configuration>
+    <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+    <SampleGuid>{F7152E7D-34B2-4B88-A5D9-17D68B786DFC}</SampleGuid>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>False</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>WDM</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>True</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>WDM</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>False</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>WDM</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>True</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>WDM</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <PropertyGroup>
+    <OutDir>$(IntDir)</OutDir>
+  </PropertyGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ItemGroup Label="WrappedTaskItems" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <TargetName>ObCallbackTest</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <TargetName>ObCallbackTest</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <TargetName>ObCallbackTest</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <TargetName>ObCallbackTest</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ResourceCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <ClCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <Optimization>Disabled</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+    <Midl>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </Midl>
+    <Link>
+      <AdditionalDependencies>%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>%(AdditionalOptions)  /INTEGRITYCHECK</AdditionalOptions>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ResourceCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <ClCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <Optimization>Disabled</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+    <Midl>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </Midl>
+    <Link>
+      <AdditionalDependencies>%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>%(AdditionalOptions)  /INTEGRITYCHECK</AdditionalOptions>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ResourceCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <ClCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <Optimization>Disabled</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+    <Midl>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </Midl>
+    <Link>
+      <AdditionalDependencies>%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>%(AdditionalOptions)  /INTEGRITYCHECK</AdditionalOptions>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ResourceCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ResourceCompile>
+    <ClCompile>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <Optimization>Disabled</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+    <Midl>
+      <AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </Midl>
+    <Link>
+      <AdditionalDependencies>%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalOptions>%(AdditionalOptions)  /INTEGRITYCHECK</AdditionalOptions>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="callback.c">
+      <AdditionalIncludeDirectories>;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreCompiledHeaderFile>pch.h</PreCompiledHeaderFile>
+      <PreCompiledHeader>Use</PreCompiledHeader>
+      <PreCompiledHeaderOutputFile>$(IntDir)\pch.h.pch</PreCompiledHeaderOutputFile>
+    </ClCompile>
+    <ClCompile Include="pchsrc.c">
+      <AdditionalIncludeDirectories>;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreCompiledHeaderFile>pch.h</PreCompiledHeaderFile>
+      <PreCompiledHeader>Create</PreCompiledHeader>
+      <PreCompiledHeaderOutputFile>$(IntDir)\pch.h.pch</PreCompiledHeaderOutputFile>
+    </ClCompile>
+    <ClCompile Include="tdriver.c">
+      <AdditionalIncludeDirectories>;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreCompiledHeaderFile>pch.h</PreCompiledHeaderFile>
+      <PreCompiledHeader>Use</PreCompiledHeader>
+      <PreCompiledHeaderOutputFile>$(IntDir)\pch.h.pch</PreCompiledHeaderOutputFile>
+    </ClCompile>
+    <ClCompile Include="util.c">
+      <AdditionalIncludeDirectories>;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreCompiledHeaderFile>pch.h</PreCompiledHeaderFile>
+      <PreCompiledHeader>Use</PreCompiledHeader>
+      <PreCompiledHeaderOutputFile>$(IntDir)\pch.h.pch</PreCompiledHeaderOutputFile>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <Inf Exclude="@(Inf)" Include="*.inf" />
+    <FilesToPackage Include="$(TargetPath)" Condition="'$(ConfigurationType)'=='Driver' or '$(ConfigurationType)'=='DynamicLibrary'" />
+    <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Exclude="@(None)" Include="*.txt;*.htm;*.html" />
+    <None Exclude="@(None)" Include="*.ico;*.cur;*.bmp;*.dlg;*.rct;*.gif;*.jpg;*.jpeg;*.wav;*.jpe;*.tiff;*.tif;*.png;*.rc2" />
+    <None Exclude="@(None)" Include="*.def;*.bat;*.hpj;*.asmx" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>
\ No newline at end of file
diff --git a/general/obcallback/driver/ObCallbackTest.vcxproj.Filters b/general/obcallback/driver/ObCallbackTest.vcxproj.Filters
new file mode 100644
index 00000000..6fb49bed
--- /dev/null
+++ b/general/obcallback/driver/ObCallbackTest.vcxproj.Filters
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;*</Extensions>
+      <UniqueIdentifier>{5962AF0C-70AA-4F9A-870A-9CA844475924}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Header Files">
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+      <UniqueIdentifier>{B9BBA35B-98FC-4830-9A01-41A3227755C9}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Resource Files">
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml</Extensions>
+      <UniqueIdentifier>{75DE6DD6-44CF-4D1B-BC2C-1EF556200FC9}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Driver Files">
+      <Extensions>inf;inv;inx;mof;mc;</Extensions>
+      <UniqueIdentifier>{593EF94F-8BBC-4C56-999C-5D894DD5456F}</UniqueIdentifier>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="callback.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="pchsrc.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="tdriver.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="util.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file
diff --git a/general/obcallback/driver/callback.c b/general/obcallback/driver/callback.c
new file mode 100644
index 00000000..39ecd1b4
--- /dev/null
+++ b/general/obcallback/driver/callback.c
@@ -0,0 +1,479 @@
+
+// Callback functions for Ob sample code tests.
+//
+// Notice:
+//
+//    Use this sample code at your own risk; there is no support from Microsoft for the sample code.
+//    In addition, this sample code is licensed to you under the terms of the Microsoft Public License
+//    (http://www.microsoft.com/opensource/licenses.mspx)
+//
+//
+
+
+#include "pch.h"
+#include "tdriver.h"
+
+//
+// Globals
+//
+
+KGUARDED_MUTEX TdCallbacksMutex;
+BOOLEAN bCallbacksInstalled = FALSE;
+
+
+#define CB_PROCESS_TERMINATE 0x0001
+#define CB_THREAD_TERMINATE  0x0001
+
+//  The following are for setting up callbacks for Process and Thread filtering
+PVOID pCBRegistrationHandle = NULL;
+
+OB_CALLBACK_REGISTRATION  CBObRegistration = { 0 };
+OB_OPERATION_REGISTRATION CBOperationRegistrations[2] = { { 0 }, { 0 } };
+UNICODE_STRING CBAltitude = {0};
+TD_CALLBACK_REGISTRATION CBCallbackRegistration = {0};
+
+// Here is the protected process
+WCHAR   TdwProtectName[NAME_SIZE+1] = {0};
+PVOID   TdProtectedTargetProcess = NULL;
+HANDLE  TdProtectedTargetProcessId = {0};
+
+
+//
+// TdDeleteProtectNameCallback
+//
+NTSTATUS TdDeleteProtectNameCallback ()
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TdDeleteProtectNameCallback entering\n");
+
+    KeAcquireGuardedMutex (&TdCallbacksMutex);
+
+    // if the callbacks are active - remove them
+    if (bCallbacksInstalled == TRUE) {
+        ObUnRegisterCallbacks(pCBRegistrationHandle);
+        pCBRegistrationHandle = NULL;
+        bCallbacksInstalled = FALSE;
+    }
+
+
+    KeReleaseGuardedMutex (&TdCallbacksMutex);
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TdDeleteProtectNameCallback exiting  - status 0x%x\n", Status
+        );
+
+    return Status;
+}
+
+
+//
+// TdProtectNameCallback
+//
+
+NTSTATUS TdProtectNameCallback (
+    _In_ PTD_PROTECTNAME_INPUT pProtectName
+)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+
+    if (!pProtectName) {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,
+            "ObCallbackTest: TdProtectNameCallback: name to protect/filter NULL pointer\n"
+        );
+    }
+    else {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+            "ObCallbackTest: TdProtectNameCallback: entering name to protect/filter %ls\n", pProtectName->Name
+        );
+    }
+    KeAcquireGuardedMutex (&TdCallbacksMutex);
+
+    // Need to copy out the name and then set the flag to filter
+    // This will allow process creation to watch for the process to be created and get the PID
+    // and then prevent any other process from opening up that PID to terminate
+
+    memcpy(TdwProtectName, pProtectName->Name, sizeof(TdwProtectName));
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: name copied     %ls\n", TdwProtectName
+    );
+
+    // Need to enable the OB callbacks
+    // once the process is matched to a newly created process, the callbacks will protect the process
+    if (bCallbacksInstalled == FALSE) {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+            "ObCallbackTest: TdProtectNameCallback: installing callbacks\n"
+        );
+
+        // Setup the Ob Registration calls
+
+        CBOperationRegistrations[0].ObjectType = PsProcessType;
+        CBOperationRegistrations[0].Operations |= OB_OPERATION_HANDLE_CREATE;
+        CBOperationRegistrations[0].Operations |= OB_OPERATION_HANDLE_DUPLICATE;
+        CBOperationRegistrations[0].PreOperation = CBTdPreOperationCallback;
+        CBOperationRegistrations[0].PostOperation = CBTdPostOperationCallback;
+
+        CBOperationRegistrations[1].ObjectType = PsThreadType;
+        CBOperationRegistrations[1].Operations |= OB_OPERATION_HANDLE_CREATE;
+        CBOperationRegistrations[1].Operations |= OB_OPERATION_HANDLE_DUPLICATE;
+        CBOperationRegistrations[1].PreOperation = CBTdPreOperationCallback;
+        CBOperationRegistrations[1].PostOperation = CBTdPostOperationCallback;
+
+
+        RtlInitUnicodeString (&CBAltitude, L"1000");
+
+        CBObRegistration.Version                    = OB_FLT_REGISTRATION_VERSION;
+        CBObRegistration.OperationRegistrationCount = 2;
+        CBObRegistration.Altitude                   = CBAltitude;
+        CBObRegistration.RegistrationContext        = &CBCallbackRegistration;
+        CBObRegistration.OperationRegistration      = CBOperationRegistrations;
+
+
+        Status = ObRegisterCallbacks (
+            &CBObRegistration,
+            &pCBRegistrationHandle       // save the registration handle to remove callbacks later
+        );
+
+        if (!NT_SUCCESS (Status))   {
+            DbgPrintEx (
+                DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,
+                "ObCallbackTest: installing OB callbacks failed  status 0x%x\n", Status
+            );
+            KeReleaseGuardedMutex (&TdCallbacksMutex); // Release the lock before exit
+            goto Exit;
+        }
+        bCallbacksInstalled = TRUE;
+
+    }
+
+
+    KeReleaseGuardedMutex (&TdCallbacksMutex);
+
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TdProtectNameCallback: name to protect/filter %ls\n", TdwProtectName
+    );
+
+Exit:
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TdProtectNameCallback: exiting  status 0x%x\n", Status
+    );
+    return Status;
+}
+
+
+//
+// TdCheckProcessMatch - function to test a command line to see if the process is to be protected
+//
+NTSTATUS TdCheckProcessMatch (
+    _In_ PCUNICODE_STRING pustrCommand,
+    _In_ PEPROCESS Process,
+    _In_ HANDLE ProcessId
+)
+{
+    NTSTATUS Status = STATUS_UNSUCCESSFUL;
+    WCHAR   CommandLineBuffer[NAME_SIZE + 1] = {0};    // force a NULL termination
+    USHORT  CommandLineBytes = 0;
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TdCheckProcessMatch: entering\n");
+
+    if (!pustrCommand || !pustrCommand->Buffer) {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,
+            "ObCallbackTest: TdCheckProcessMatch: no Command line provided\n"
+        );
+        Status = FALSE;
+        goto Exit;
+    }
+    else {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+            "ObCallbackTest: TdCheckProcessMatch:              checking for %ls\n", TdwProtectName
+        );
+    }
+
+    KeAcquireGuardedMutex (&TdCallbacksMutex);
+
+
+    // Make sure that the CommandLineBuffer is NULL terminated
+    if (pustrCommand->Length < (NAME_SIZE * sizeof(WCHAR)))
+        CommandLineBytes = pustrCommand->Length;
+    else
+        CommandLineBytes = NAME_SIZE * sizeof(WCHAR);
+
+    if (CommandLineBytes) {
+        memcpy(CommandLineBuffer, pustrCommand->Buffer, CommandLineBytes);
+
+        // now check if the process to protect is in the command line
+
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+            "ObCallbackTest: TdCheckProcessMatch: command line %ls\n", CommandLineBuffer
+            );
+
+        if (NULL != wcsstr (CommandLineBuffer, TdwProtectName)) {
+            DbgPrintEx (
+                DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+                "ObCallbackTest: TdCheckProcessMatch: match FOUND\n"
+                );
+
+            // Set the process to watch
+            TdProtectedTargetProcess = Process;
+            TdProtectedTargetProcessId = ProcessId;
+
+            Status = STATUS_SUCCESS;
+        }
+    }
+    else {
+        Status = FALSE;     // no command line buffer provided
+    }
+
+    KeReleaseGuardedMutex (&TdCallbacksMutex);
+
+
+Exit:
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TdCheckProcessMatch: leaving    status  0x%x\n", Status
+    );
+    return Status;
+}
+
+
+//
+// CBTdPreOperationCallback
+//
+OB_PREOP_CALLBACK_STATUS
+CBTdPreOperationCallback (
+    _In_ PVOID RegistrationContext,
+    _Inout_ POB_PRE_OPERATION_INFORMATION PreInfo
+)
+{
+    PTD_CALLBACK_REGISTRATION CallbackRegistration;
+
+    ACCESS_MASK AccessBitsToClear     = 0;
+    ACCESS_MASK AccessBitsToSet       = 0;
+    ACCESS_MASK InitialDesiredAccess  = 0;
+    ACCESS_MASK OriginalDesiredAccess = 0;
+
+
+    PACCESS_MASK DesiredAccess = NULL;
+
+    LPCWSTR ObjectTypeName = NULL;
+    LPCWSTR OperationName = NULL;
+
+    // Not using driver specific values at this time
+    CallbackRegistration = (PTD_CALLBACK_REGISTRATION)RegistrationContext;
+
+
+    TD_ASSERT (PreInfo->CallContext == NULL);
+
+    // Only want to filter attempts to access protected process
+    // all other processes are left untouched
+
+    if (PreInfo->ObjectType == *PsProcessType)  {
+        //
+        // Ignore requests for processes other than our target process.
+        //
+
+        // if (TdProtectedTargetProcess != NULL &&
+        //    TdProtectedTargetProcess != PreInfo->Object)
+        if (TdProtectedTargetProcess != PreInfo->Object)
+        {
+            goto Exit;
+        }
+
+        //
+        // Also ignore requests that are trying to open/duplicate the current
+        // process.
+        //
+
+        if (PreInfo->Object == PsGetCurrentProcess())   {
+            DbgPrintEx (
+                DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+                "ObCallbackTest: CBTdPreOperationCallback: ignore process open/duplicate from the protected process itself\n");
+            goto Exit;
+        }
+
+        ObjectTypeName = L"PsProcessType";
+        AccessBitsToClear     = CB_PROCESS_TERMINATE;
+        AccessBitsToSet       = 0;
+    }
+    else if (PreInfo->ObjectType == *PsThreadType)  {
+        HANDLE ProcessIdOfTargetThread = PsGetThreadProcessId ((PETHREAD)PreInfo->Object);
+
+        //
+        // Ignore requests for threads belonging to processes other than our
+        // target process.
+        //
+
+        // if (CallbackRegistration->TargetProcess   != NULL &&
+        //     CallbackRegistration->TargetProcessId != ProcessIdOfTargetThread)
+        if (TdProtectedTargetProcessId != ProcessIdOfTargetThread)  {
+            goto Exit;
+        }
+
+        //
+        // Also ignore requests for threads belonging to the current processes.
+        //
+
+        if (ProcessIdOfTargetThread == PsGetCurrentProcessId()) {
+            DbgPrintEx (
+                DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+                "ObCallbackTest: CBTdPreOperationCallback: ignore thread open/duplicate from the protected process itself\n");
+            goto Exit;
+        }
+
+        ObjectTypeName = L"PsThreadType";
+        AccessBitsToClear     = CB_THREAD_TERMINATE;
+        AccessBitsToSet       = 0;
+    }
+    else    {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,
+            "ObCallbackTest: CBTdPreOperationCallback: unexpected object type\n");
+        goto Exit;
+    }
+
+    switch (PreInfo->Operation) {
+    case OB_OPERATION_HANDLE_CREATE:
+        DesiredAccess = &PreInfo->Parameters->CreateHandleInformation.DesiredAccess;
+        OriginalDesiredAccess = PreInfo->Parameters->CreateHandleInformation.OriginalDesiredAccess;
+
+        OperationName = L"OB_OPERATION_HANDLE_CREATE";
+        break;
+
+    case OB_OPERATION_HANDLE_DUPLICATE:
+        DesiredAccess = &PreInfo->Parameters->DuplicateHandleInformation.DesiredAccess;
+        OriginalDesiredAccess = PreInfo->Parameters->DuplicateHandleInformation.OriginalDesiredAccess;
+
+        OperationName = L"OB_OPERATION_HANDLE_DUPLICATE";
+        break;
+
+    default:
+        TD_ASSERT (FALSE);
+        break;
+    }
+
+    InitialDesiredAccess = *DesiredAccess;
+
+    // Filter only if request made outside of the kernel
+    if (PreInfo->KernelHandle != 1) {
+        *DesiredAccess &= ~AccessBitsToClear;
+        *DesiredAccess |=  AccessBitsToSet;
+    }
+
+    //
+    // Set call context.
+    //
+
+    TdSetCallContext (PreInfo, CallbackRegistration);
+
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "ObCallbackTest: CBTdPreOperationCallback: PROTECTED process %p (ID 0x%p)\n",
+        TdProtectedTargetProcess,
+        (PVOID)TdProtectedTargetProcessId
+    );
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: CBTdPreOperationCallback\n"
+        "    Client Id:    %p:%p\n"
+        "    Object:       %p\n"
+        "    Type:         %ls\n"
+        "    Operation:    %ls (KernelHandle=%d)\n"
+        "    OriginalDesiredAccess: 0x%x\n"
+        "    DesiredAccess (in):    0x%x\n"
+        "    DesiredAccess (out):   0x%x\n",
+        PsGetCurrentProcessId(),
+        PsGetCurrentThreadId(),
+        PreInfo->Object,
+        ObjectTypeName,
+        OperationName,
+        PreInfo->KernelHandle,
+        OriginalDesiredAccess,
+        InitialDesiredAccess,
+        *DesiredAccess
+    );
+
+Exit:
+
+    return OB_PREOP_SUCCESS;
+}
+
+//
+// TdPostOperationCallback
+//
+
+VOID
+CBTdPostOperationCallback (
+    _In_ PVOID RegistrationContext,
+    _In_ POB_POST_OPERATION_INFORMATION PostInfo
+    )
+{
+    PTD_CALLBACK_REGISTRATION CallbackRegistration = (PTD_CALLBACK_REGISTRATION)RegistrationContext;
+
+    TdCheckAndFreeCallContext (PostInfo, CallbackRegistration);
+
+    if (PostInfo->ObjectType == *PsProcessType) {
+        //
+        // Ignore requests for processes other than our target process.
+        //
+
+        if (CallbackRegistration->TargetProcess != NULL &&
+            CallbackRegistration->TargetProcess != PostInfo->Object
+        )   {
+            return;
+        }
+
+        //
+        // Also ignore requests that are trying to open/duplicate the current
+        // process.
+        //
+
+        if (PostInfo->Object == PsGetCurrentProcess())  {
+            return;
+        }
+    }
+    else if (PostInfo->ObjectType == *PsThreadType) {
+        HANDLE ProcessIdOfTargetThread = PsGetThreadProcessId ((PETHREAD)PostInfo->Object);
+
+        //
+        // Ignore requests for threads belonging to processes other than our
+        // target process.
+        //
+
+        if (CallbackRegistration->TargetProcess   != NULL &&
+            CallbackRegistration->TargetProcessId != ProcessIdOfTargetThread
+        )   {
+            return;
+        }
+
+        //
+        // Also ignore requests for threads belonging to the current processes.
+        //
+
+        if (ProcessIdOfTargetThread == PsGetCurrentProcessId()) {
+            return;
+        }
+    }
+    else    {
+        TD_ASSERT (FALSE);
+    }
+
+}
+
diff --git a/general/obcallback/driver/pch.h b/general/obcallback/driver/pch.h
new file mode 100644
index 00000000..9cab74cc
--- /dev/null
+++ b/general/obcallback/driver/pch.h
@@ -0,0 +1,13 @@
+
+// Notice:
+//
+//    Use this sample code at your own risk; there is no support from Microsoft for the sample code.
+//    In addition, this sample code is licensed to you under the terms of the Microsoft Public License
+//    (http://www.microsoft.com/opensource/licenses.mspx)
+
+#pragma once
+
+#include <ntddk.h>
+#include <ntstrsafe.h>
+
+
diff --git a/general/obcallback/driver/pchsrc.c b/general/obcallback/driver/pchsrc.c
new file mode 100644
index 00000000..17305716
--- /dev/null
+++ b/general/obcallback/driver/pchsrc.c
@@ -0,0 +1 @@
+#include "pch.h"
\ No newline at end of file
diff --git a/general/obcallback/driver/shared.h b/general/obcallback/driver/shared.h
new file mode 100644
index 00000000..cea7f5f9
--- /dev/null
+++ b/general/obcallback/driver/shared.h
@@ -0,0 +1,95 @@
+/*++
+
+Module Name:
+
+    shared.h
+
+Abstract:
+
+    This contains declarations shared by the Ob/Ps callback test driver and
+    the user mode test app.
+
+
+// Notice:
+//
+//    Use this sample code at your own risk; there is no support from Microsoft for the sample code.
+//    In addition, this sample code is licensed to you under the terms of the Microsoft Public License
+//    (http://www.microsoft.com/opensource/licenses.mspx)
+
+--*/
+
+#pragma once
+
+#pragma warning(disable:4214) // bit field types other than int
+#pragma warning(disable:4201) // nameless struct/union
+
+//
+// TD_ASSERT
+//
+// This macro is identical to NT_ASSERT but works in fre builds as well.
+//
+// It is used for error checking in the driver in cases where
+// we can't easily report the error to the user mode app, or the
+// error is so severe that we should break in immediately to
+// investigate.
+//
+// It's better than DbgBreakPoint because it provides additional info
+// that can be dumped with .exr -1, and individual asserts can be disabled
+// from kd using 'ahi' command.
+//
+
+#define TD_ASSERT(_exp) \
+    ((!(_exp)) ? \
+        (__annotation(L"Debug", L"AssertFail", L#_exp), \
+         DbgRaiseAssertionFailure(), FALSE) : \
+        TRUE)
+
+//
+// Driver and device names
+// It is important to change the names of the binaries
+// in the sample code to be unique for your own use.
+//
+
+#define TD_DRIVER_NAME             L"ObCallbackTest"
+#define TD_DRIVER_NAME_WITH_EXT    L"ObCallbackTest.sys"
+
+#define TD_NT_DEVICE_NAME          L"\\Device\\ObCallbackTest"
+#define TD_DOS_DEVICES_LINK_NAME   L"\\DosDevices\\ObCallbackTest"
+#define TD_WIN32_DEVICE_NAME       L"\\\\.\\ObCallbackTest"
+
+
+#define NAME_SIZE   200
+
+#define TD_INVALID_CALLBACK_ID ((ULONG)-1)
+
+//
+// IOCTLs exposed by the driver.
+//
+
+// #define TD_IOCTL_REGISTER_CALLBACK   CTL_CODE (FILE_DEVICE_UNKNOWN, (0x800 + 0), METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+// #define TD_IOCTL_UNREGISTER_CALLBACK CTL_CODE (FILE_DEVICE_UNKNOWN, (0x800 + 1), METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define TD_IOCTL_PROTECT_NAME_CALLBACK        CTL_CODE (FILE_DEVICE_UNKNOWN, (0x800 + 2), METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define TD_IOCTL_UNPROTECT_CALLBACK           CTL_CODE (FILE_DEVICE_UNKNOWN, (0x800 + 3), METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+
+
+#define TDProtectName_Protect  0            // name of programs to proect and filter out the desiredAccess on Process Open
+#define TDProtectName_Reject   1            // name of programs to reject during ProcessCreate
+
+//
+// Structures used by TD_IOCTL_PROTECTNAME
+//
+
+typedef struct _TD_PROTECTNAME_INPUT {
+    ULONG Operation;
+    WCHAR Name[NAME_SIZE+1];      // what is the filename to protect - extra wchar for forced NULL
+}
+TD_PROTECTNAME_INPUT, *PTD_PROTECTNAME_INPUT;
+
+//
+// Structures used by TD_IOCTL_UNPROTECT_CALLBACK
+//
+
+typedef struct _TD_UNPROTECT_CALLBACK_INPUT {
+    ULONG UnusedParameter;
+}
+TD_UNPROTECT_CALLBACK_INPUT, *PTD_UNPROTECT_CALLBACK_INPUT;
diff --git a/general/obcallback/driver/tdriver.c b/general/obcallback/driver/tdriver.c
new file mode 100644
index 00000000..641635ee
--- /dev/null
+++ b/general/obcallback/driver/tdriver.c
@@ -0,0 +1,532 @@
+/*++
+
+Module Name:
+
+    tdriver.c
+
+Abstract:
+
+    Main module for the Ob and Ps sample code
+
+Notice:
+    Use this sample code at your own risk; there is no support from Microsoft for the sample code.
+    In addition, this sample code is licensed to you under the terms of the Microsoft Public License
+    (http://www.microsoft.com/opensource/licenses.mspx)
+
+
+--*/
+
+#include "pch.h"
+#include "tdriver.h"
+
+//
+// Process notify routines.
+//
+
+BOOLEAN TdProcessNotifyRoutineSet2 = FALSE;
+
+// allow filter the requested access
+BOOLEAN TdbProtectName = FALSE;
+BOOLEAN TdbRejectName = FALSE;
+
+//
+// Function declarations
+//
+DRIVER_INITIALIZE  DriverEntry;
+
+_Dispatch_type_(IRP_MJ_CREATE) DRIVER_DISPATCH TdDeviceCreate;
+_Dispatch_type_(IRP_MJ_CLOSE) DRIVER_DISPATCH TdDeviceClose;
+_Dispatch_type_(IRP_MJ_CLEANUP) DRIVER_DISPATCH TdDeviceCleanup;
+_Dispatch_type_(IRP_MJ_DEVICE_CONTROL) DRIVER_DISPATCH TdDeviceControl;
+
+DRIVER_UNLOAD   TdDeviceUnload;
+
+VOID
+TdCreateProcessNotifyRoutine2 (
+    _Inout_ PEPROCESS Process,
+    _In_ HANDLE ProcessId,
+    _In_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo
+    )
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+
+    if (CreateInfo != NULL)
+    {
+
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+            "ObCallbackTest: TdCreateProcessNotifyRoutine2: process %p (ID 0x%p) created, creator %Ix:%Ix\n"
+            "    command line %wZ\n"
+            "    file name %wZ (FileOpenNameAvailable: %d)\n",
+            Process,
+            (PVOID)ProcessId,
+            (ULONG_PTR)CreateInfo->CreatingThreadId.UniqueProcess,
+            (ULONG_PTR)CreateInfo->CreatingThreadId.UniqueThread,
+            CreateInfo->CommandLine,
+            CreateInfo->ImageFileName,
+            CreateInfo->FileOpenNameAvailable
+        );
+
+        // Search for matching process to protect only if filtering
+        if (TdbProtectName) {
+            if (CreateInfo->CommandLine != NULL)
+            {
+                Status = TdCheckProcessMatch(CreateInfo->CommandLine, Process, ProcessId);
+
+                if (Status == STATUS_SUCCESS) {
+                    DbgPrintEx (
+                        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "ObCallbackTest: TdCreateProcessNotifyRoutine2: PROTECTING process %p (ID 0x%p)\n",
+                        Process,
+                        (PVOID)ProcessId
+                    );
+                }
+            }
+
+        }
+
+        // Search for matching process to reject process creation
+        if (TdbRejectName) {
+            if (CreateInfo->CommandLine != NULL)
+            {
+                Status = TdCheckProcessMatch(CreateInfo->CommandLine, Process, ProcessId);
+
+                if (Status == STATUS_SUCCESS) {
+                    DbgPrintEx (
+                        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "ObCallbackTest: TdCreateProcessNotifyRoutine2: REJECTING process %p (ID 0x%p)\n",
+                        Process,
+                        (PVOID)ProcessId
+                    );
+
+                    CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
+                }
+            }
+
+        }
+    }
+    else
+    {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "ObCallbackTest: TdCreateProcessNotifyRoutine2: process %p (ID 0x%p) destroyed\n",
+            Process,
+            (PVOID)ProcessId
+        );
+    }
+}
+
+//
+// DriverEntry
+//
+
+NTSTATUS
+DriverEntry (
+    _In_ PDRIVER_OBJECT  DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+)
+{
+    NTSTATUS Status;
+    UNICODE_STRING NtDeviceName = RTL_CONSTANT_STRING (TD_NT_DEVICE_NAME);
+    UNICODE_STRING DosDevicesLinkName = RTL_CONSTANT_STRING (TD_DOS_DEVICES_LINK_NAME);
+    PDEVICE_OBJECT Device = NULL;
+    BOOLEAN SymLinkCreated = FALSE;
+    USHORT CallbackVersion;
+
+    UNREFERENCED_PARAMETER (RegistryPath);
+
+    DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "ObCallbackTest: DriverEntry: Driver loaded. Use ed nt!Kd_IHVDRIVER_Mask f (or 7) to enable more traces\n");
+
+    CallbackVersion = ObGetFilterVersion();
+
+    DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "ObCallbackTest: DriverEntry: Callback version 0x%hx\n", CallbackVersion);
+
+    //
+    // Initialize globals.
+    //
+
+    KeInitializeGuardedMutex (&TdCallbacksMutex);
+    
+    //
+    // Create our device object.
+    //
+
+    Status = IoCreateDevice (                    
+        DriverObject,                 // pointer to driver object
+        0,                            // device extension size
+        &NtDeviceName,                // device name
+        FILE_DEVICE_UNKNOWN,          // device type
+        0,                            // device characteristics
+        FALSE,                        // not exclusive
+        &Device);                     // returned device object pointer
+
+    if (! NT_SUCCESS(Status))
+    {
+        goto Exit;
+    }
+
+    TD_ASSERT (Device == DriverObject->DeviceObject);
+
+    //
+    // Set dispatch routines.
+    //
+
+    DriverObject->MajorFunction[IRP_MJ_CREATE]         = TdDeviceCreate;
+    DriverObject->MajorFunction[IRP_MJ_CLOSE]          = TdDeviceClose;
+    DriverObject->MajorFunction[IRP_MJ_CLEANUP]        = TdDeviceCleanup;
+    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = TdDeviceControl;
+    DriverObject->DriverUnload                         = TdDeviceUnload;
+
+    //
+    // Create a link in the Win32 namespace.
+    //
+    
+    Status = IoCreateSymbolicLink (&DosDevicesLinkName, &NtDeviceName);
+
+    if (! NT_SUCCESS(Status))
+    {
+        goto Exit;
+    }
+
+    SymLinkCreated = TRUE;
+
+    //
+    // Set process create routines.
+    //
+
+    Status = PsSetCreateProcessNotifyRoutineEx (
+        TdCreateProcessNotifyRoutine2,
+        FALSE
+    );
+
+    if (! NT_SUCCESS(Status))
+    {
+        DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "ObCallbackTest: DriverEntry: PsSetCreateProcessNotifyRoutineEx(2) returned 0x%x\n", Status);
+        goto Exit;
+    }
+
+    TdProcessNotifyRoutineSet2 = TRUE;
+
+Exit:
+
+    if (!NT_SUCCESS (Status))
+    {
+        if (TdProcessNotifyRoutineSet2 == TRUE)
+        {
+            Status = PsSetCreateProcessNotifyRoutineEx (
+                TdCreateProcessNotifyRoutine2,
+                TRUE
+            );
+
+            TD_ASSERT (Status == STATUS_SUCCESS);
+
+            TdProcessNotifyRoutineSet2 = FALSE;
+        }
+
+        if (SymLinkCreated == TRUE)
+        {
+            IoDeleteSymbolicLink (&DosDevicesLinkName);
+        }
+
+        if (Device != NULL)
+        {
+            IoDeleteDevice (Device);
+        }
+    }
+
+    return Status;
+}
+
+//
+// Function:
+//
+//     TdDeviceUnload
+//
+// Description:
+//
+//     This function handles driver unloading. All this driver needs to do 
+//     is to delete the device object and the symbolic link between our 
+//     device name and the Win32 visible name.
+//
+
+VOID
+TdDeviceUnload (
+    _In_ PDRIVER_OBJECT DriverObject
+)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+    UNICODE_STRING DosDevicesLinkName = RTL_CONSTANT_STRING (TD_DOS_DEVICES_LINK_NAME);
+
+    DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "ObCallbackTest: TdDeviceUnload\n");
+
+    //
+    // Unregister process notify routines.
+    //
+
+    if (TdProcessNotifyRoutineSet2 == TRUE)
+    {
+        Status = PsSetCreateProcessNotifyRoutineEx (
+            TdCreateProcessNotifyRoutine2,
+            TRUE
+        );
+
+        TD_ASSERT (Status == STATUS_SUCCESS);
+
+        TdProcessNotifyRoutineSet2 = FALSE;
+    }
+
+    // remove filtering and remove any OB callbacks
+    TdbProtectName = FALSE;
+    Status = TdDeleteProtectNameCallback();
+    TD_ASSERT (Status == STATUS_SUCCESS);
+
+    //
+    // Delete the link from our device name to a name in the Win32 namespace.
+    //
+
+    Status = IoDeleteSymbolicLink (&DosDevicesLinkName);
+    if (Status != STATUS_INSUFFICIENT_RESOURCES) {
+        //
+        // IoDeleteSymbolicLink can fail with STATUS_INSUFFICIENT_RESOURCES.
+        //
+    
+        TD_ASSERT (NT_SUCCESS (Status));
+
+    }
+
+
+    //
+    // Delete our device object.
+    //
+
+    IoDeleteDevice (DriverObject->DeviceObject);
+}
+
+//
+// Function:
+//
+//     TdDeviceCreate
+//
+// Description:
+//
+//     This function handles the 'create' irp.
+//
+
+
+NTSTATUS
+TdDeviceCreate (
+    IN PDEVICE_OBJECT  DeviceObject,
+    IN PIRP  Irp
+)
+{
+    UNREFERENCED_PARAMETER (DeviceObject);
+
+    Irp->IoStatus.Status = STATUS_SUCCESS;
+    Irp->IoStatus.Information = 0;
+    IoCompleteRequest (Irp, IO_NO_INCREMENT);
+
+    return STATUS_SUCCESS;
+}
+
+//
+// Function:
+//
+//     TdDeviceClose
+//
+// Description:
+//
+//     This function handles the 'close' irp.
+//
+
+NTSTATUS
+TdDeviceClose (
+    IN PDEVICE_OBJECT  DeviceObject,
+    IN PIRP  Irp
+)
+{
+    UNREFERENCED_PARAMETER (DeviceObject);
+
+    Irp->IoStatus.Status = STATUS_SUCCESS;
+    Irp->IoStatus.Information = 0;
+    IoCompleteRequest (Irp, IO_NO_INCREMENT);
+
+    return STATUS_SUCCESS;
+}
+
+//
+// Function:
+//
+//     TdDeviceCleanup
+//
+// Description:
+//
+//     This function handles the 'cleanup' irp.
+//
+
+NTSTATUS
+TdDeviceCleanup (
+    IN PDEVICE_OBJECT  DeviceObject,
+    IN PIRP  Irp
+)
+{
+    UNREFERENCED_PARAMETER (DeviceObject);
+
+    Irp->IoStatus.Status = STATUS_SUCCESS;
+    Irp->IoStatus.Information = 0;
+    IoCompleteRequest (Irp, IO_NO_INCREMENT);
+
+    return STATUS_SUCCESS;
+}
+
+//
+// TdControlProtectName
+//
+
+NTSTATUS TdControlProtectName (
+    IN PDEVICE_OBJECT  DeviceObject,
+    IN PIRP  Irp
+)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+    PIO_STACK_LOCATION IrpStack = NULL;
+    ULONG InputBufferLength = 0;
+    PTD_PROTECTNAME_INPUT pProtectNameInput = NULL;
+
+    UNREFERENCED_PARAMETER (DeviceObject);
+
+
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TdControlProtectName: Entering\n");
+
+    IrpStack = IoGetCurrentIrpStackLocation (Irp);
+    InputBufferLength = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
+
+    if (InputBufferLength < sizeof (TD_PROTECTNAME_INPUT))
+    {
+        Status = STATUS_BUFFER_OVERFLOW;
+        goto Exit;
+    }
+
+    pProtectNameInput = (PTD_PROTECTNAME_INPUT)Irp->AssociatedIrp.SystemBuffer;
+
+    Status = TdProtectNameCallback (pProtectNameInput);
+
+    switch (pProtectNameInput->Operation) {
+        case TDProtectName_Protect:
+            // Begin filtering access rights
+            TdbProtectName = TRUE;
+            TdbRejectName = FALSE;
+            break;
+    
+        case TDProtectName_Reject:
+            // Begin reject process creation on match
+            TdbProtectName = FALSE;
+            TdbRejectName = TRUE;
+            break;
+    }
+
+
+Exit:
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TD_IOCTL_PROTECTNAME: Status %x\n", Status);
+
+    return Status;
+}
+
+//
+// TdControlUnprotect
+//
+
+NTSTATUS TdControlUnprotect (
+    IN PDEVICE_OBJECT  DeviceObject,
+    IN PIRP  Irp
+)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+    // PIO_STACK_LOCATION IrpStack = NULL;
+    // ULONG InputBufferLength = 0;
+
+    UNREFERENCED_PARAMETER (DeviceObject);
+    UNREFERENCED_PARAMETER (Irp);
+
+    // IrpStack = IoGetCurrentIrpStackLocation (Irp);
+    // InputBufferLength = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
+
+    // No need to check length of passed in parameters as we do not need any information from that
+
+    // do not filter requested access
+    Status = TdDeleteProtectNameCallback();
+    if (Status != STATUS_SUCCESS) {
+        DbgPrintEx (
+            DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+            "ObCallbackTest: TdDeleteProtectNameCallback:  status 0x%x\n", Status);
+        }
+    TdbProtectName = FALSE;
+    TdbRejectName = FALSE;
+
+//Exit:
+    DbgPrintEx (
+        DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL,
+        "ObCallbackTest: TD_IOCTL_UNPROTECT: exiting - status 0x%x\n", Status);
+
+    return Status;
+}
+
+
+//
+// Function:
+//
+//     TdDeviceControl
+//
+// Description:
+//
+//     This function handles 'control' irp.
+//
+
+NTSTATUS
+TdDeviceControl (
+    IN PDEVICE_OBJECT  DeviceObject,
+    IN PIRP  Irp
+)
+{
+    PIO_STACK_LOCATION IrpStack;
+    ULONG Ioctl;
+    NTSTATUS Status;
+
+    UNREFERENCED_PARAMETER (DeviceObject);
+
+
+    Status = STATUS_SUCCESS;
+
+    IrpStack = IoGetCurrentIrpStackLocation (Irp);
+    Ioctl = IrpStack->Parameters.DeviceIoControl.IoControlCode;
+
+    DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "TdDeviceControl: entering - ioctl code 0x%x\n", Ioctl);
+
+    switch (Ioctl)
+    {
+    case TD_IOCTL_PROTECT_NAME_CALLBACK:
+
+        Status = TdControlProtectName (DeviceObject, Irp);
+        break;
+
+    case TD_IOCTL_UNPROTECT_CALLBACK:
+
+        Status = TdControlUnprotect (DeviceObject, Irp);
+        break;
+
+
+    default:
+        DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "TdDeviceControl: unrecognized ioctl code 0x%x\n", Ioctl);
+        break;
+    }
+
+    //
+    // Complete the irp and return.
+    //
+
+    Irp->IoStatus.Status = Status;
+    IoCompleteRequest (Irp, IO_NO_INCREMENT);
+
+    DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "TdDeviceControl leaving - status 0x%x\n", Status);
+    return Status;
+}
diff --git a/general/obcallback/driver/tdriver.h b/general/obcallback/driver/tdriver.h
new file mode 100644
index 00000000..b7dedd02
--- /dev/null
+++ b/general/obcallback/driver/tdriver.h
@@ -0,0 +1,125 @@
+/*++
+
+Module Name:
+
+    tdriver.h
+
+Abstract:
+
+    This module declarations for the Ob/Ps callback test driver.
+
+
+// Notice:
+//
+//    Use this sample code at your own risk; there is no support from Microsoft for the sample code.
+//    In addition, this sample code is licensed to you under the terms of the Microsoft Public License
+//    (http://www.microsoft.com/opensource/licenses.mspx)
+
+--*/
+
+#pragma once
+
+#include "shared.h"
+
+#define TD_CALLBACK_REGISTRATION_TAG  '0bCO' // TD_CALLBACK_REGISTRATION structure.
+#define TD_CALL_CONTEXT_TAG           '1bCO' // TD_CALL_CONTEXT structure.
+
+
+typedef struct _TD_CALLBACK_PARAMETERS {
+    ACCESS_MASK AccessBitsToClear;
+    ACCESS_MASK AccessBitsToSet;
+}
+TD_CALLBACK_PARAMETERS, *PTD_CALLBACK_PARAMETERS;
+
+//
+// TD_CALLBACK_REGISTRATION
+//
+
+typedef struct _TD_CALLBACK_REGISTRATION {
+
+    //
+    // Handle returned by ObRegisterCallbacks.
+    //
+
+    PVOID RegistrationHandle;
+
+    //
+    // If not NULL, filter only requests to open/duplicate handles to this
+    // process (or one of its threads).
+    //
+
+    PVOID TargetProcess;
+    HANDLE TargetProcessId;
+
+
+    //
+    // Currently each TD_CALLBACK_REGISTRATION has at most one process and one
+    // thread callback. That is, we can't register more than one callback for
+    // the same object type with a single ObRegisterCallbacks call.
+    //
+
+    TD_CALLBACK_PARAMETERS ProcessParams;
+    TD_CALLBACK_PARAMETERS ThreadParams;
+
+    ULONG RegistrationId;        // Index in the global TdCallbacks array.
+
+}
+TD_CALLBACK_REGISTRATION, *PTD_CALLBACK_REGISTRATION;
+
+//
+// TD_CALL_CONTEXT
+//
+
+typedef struct _TD_CALL_CONTEXT
+{
+    PTD_CALLBACK_REGISTRATION CallbackRegistration;
+
+    OB_OPERATION Operation;
+    PVOID Object;
+    POBJECT_TYPE ObjectType;
+}
+TD_CALL_CONTEXT, *PTD_CALL_CONTEXT;
+
+extern KGUARDED_MUTEX TdCallbacksMutex;
+
+NTSTATUS TdDeleteCallback (
+    _In_ ULONG RegistrationId
+);
+
+// delete the process/thead OB callbacks
+NTSTATUS TdDeleteProtectNameCallback ();
+
+
+
+NTSTATUS TdProtectNameCallback(
+    _In_ PTD_PROTECTNAME_INPUT pProtectName
+);
+
+NTSTATUS TdCheckProcessMatch (
+    _In_ PCUNICODE_STRING pustrCommand,
+    _In_ PEPROCESS Process,
+    _In_ HANDLE ProcessId
+);
+
+OB_PREOP_CALLBACK_STATUS
+CBTdPreOperationCallback (
+    _In_ PVOID RegistrationContext,
+    _Inout_ POB_PRE_OPERATION_INFORMATION PreInfo
+);
+
+VOID
+CBTdPostOperationCallback (
+    _In_ PVOID RegistrationContext,
+    _In_ POB_POST_OPERATION_INFORMATION PostInfo
+);
+
+VOID TdSetCallContext (
+    _Inout_ POB_PRE_OPERATION_INFORMATION PreInfo,
+    _In_ PTD_CALLBACK_REGISTRATION CallbackRegistration
+);
+
+VOID TdCheckAndFreeCallContext (
+    _Inout_ POB_POST_OPERATION_INFORMATION PostInfo,
+    _In_ PTD_CALLBACK_REGISTRATION CallbackRegistration
+);
+
diff --git a/general/obcallback/driver/util.c b/general/obcallback/driver/util.c
new file mode 100644
index 00000000..c00e96a3
--- /dev/null
+++ b/general/obcallback/driver/util.c
@@ -0,0 +1,73 @@
+/*++
+
+Module Name:
+
+    util.c
+
+Notice:
+    Use this sample code at your own risk; there is no support from Microsoft for the sample code.
+    In addition, this sample code is licensed to you under the terms of the Microsoft Public License
+    (http://www.microsoft.com/opensource/licenses.mspx)
+
+
+--*/
+
+#include "pch.h"
+#include "tdriver.h"
+
+//
+// TdSetCallContext
+//
+// Creates a call context object and stores a pointer to it
+// in the supplied OB_PRE_OPERATION_INFORMATION structure.
+//
+// This function is called from a pre-notification. The created call context
+// object then has to be freed in a corresponding post-notification using
+// TdCheckAndFreeCallContext.
+//
+
+void TdSetCallContext (
+    _Inout_ POB_PRE_OPERATION_INFORMATION PreInfo,
+    _In_ PTD_CALLBACK_REGISTRATION CallbackRegistration
+)
+{
+    PTD_CALL_CONTEXT CallContext;
+
+    CallContext = (PTD_CALL_CONTEXT) ExAllocatePoolWithTag (
+        PagedPool, sizeof(TD_CALL_CONTEXT), TD_CALL_CONTEXT_TAG
+    );
+
+    if (CallContext == NULL)
+    {
+        return;
+    }
+
+    RtlZeroMemory (CallContext, sizeof(TD_CALL_CONTEXT));
+
+    CallContext->CallbackRegistration = CallbackRegistration;
+    CallContext->Operation  = PreInfo->Operation;
+    CallContext->Object     = PreInfo->Object;
+    CallContext->ObjectType = PreInfo->ObjectType;
+
+    PreInfo->CallContext = CallContext;
+}
+
+void TdCheckAndFreeCallContext (
+    _Inout_ POB_POST_OPERATION_INFORMATION PostInfo,
+    _In_ PTD_CALLBACK_REGISTRATION CallbackRegistration
+)
+{
+    PTD_CALL_CONTEXT CallContext = (PTD_CALL_CONTEXT)PostInfo->CallContext;
+
+    if (CallContext != NULL)
+    {
+        TD_ASSERT (CallContext->CallbackRegistration == CallbackRegistration);
+
+        TD_ASSERT (CallContext->Operation  == PostInfo->Operation);
+        TD_ASSERT (CallContext->Object     == PostInfo->Object);
+        TD_ASSERT (CallContext->ObjectType == PostInfo->ObjectType);
+
+        ExFreePoolWithTag (CallContext, TD_CALL_CONTEXT_TAG);
+    }
+}
+