blob: e0efce2c80c501f57c2e66b5e75595accb592cb3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
---
page_type: sample
description: "Demonstrates the use of registered callbacks for process protection."
languages:
- cpp
products:
- windows
---
<!---
name: ObCallback Callback Registration Driver
platform: WDM
language: cpp
category: General
description: Demonstrates the use of registered callbacks for process protection.
samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617716
--->
# ObCallback Callback Registration Driver
The ObCallback sample driver demonstrates the use of registered callbacks for process protection. The driver registers control callbacks which are called at process creation.
## Design and Operation
The sample exercises both the [**PsSetCreateProcessNotifyRoutineEx**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff559951) and the [**ObRegisterCallbacks**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff558692) routines. The first example uses the **ObRegisterCallbacks** routine and a callback to restrict requested access rights during a open process action. The second example uses the **PsSetCreateProcessNotifyRoutineEx** routine to reject a process creation by examining the command line.
The following is a command line usage scenario to exercise access restriction:
```
C:\> obcallbacktestctrl.exe -? (for command line help)
C:\> obcallbacktestctrl.exe -install (installs the kernel driver)
C:\> obcallbacktestctrl.exe -name notepad (specifies that the string "notepad" will be watched as a protected executable)
(now you can start up "notepad.exe")
C:\> notepad
C:\> tlist (locate the process ID of notepad.exe)
C:\> kill -f 2329 (attempt to kill off the notepad.exe with a PID of 2329)
process notepad.exe (2329) - 'Untitled - Notepad' could not be killed
C:\> obcallbacktestctrl.exe -deprotect (remove the protections on the notepad process)
C:\> kill -f 2329 (attempt to kill off the process - which will succeed)
C:\> obcallbacktestctrl.exe -uninstall (uninstall the kernel driver)
```
The following is another sample test you can run to prevent a process from being created:
```
C:\> obcallbacktestctrl.exe -install (installs the kernel driver)
C:\> obcallbacktestctrl.exe -reject notepad (specifies that the string "notepad" will be watched and prevented from starting as a process)
C:\> notepad (now you can start up "notepad.exe")
Access is denied.
```
|
