Guest User

Callbacks Hook structures

a guest
Jul 14th, 2016
326
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2. !object \\ObjectTypes // commond to get Objects aaddress
  3.  
  4. typedef struct _CALLBACK_ENTRY {
  5.     WORD Version; // 0x0
  6.     WORD OperationRegistrationCount; // 0x2
  7.     DWORD unk1; // 0x4
  8.     PVOID RegistrationContext; // 0x8
  9.     UNICODE_STRING Altitude; // 0x10
  10. } CALLBACK_ENTRY, *PCALLBACK_ENTRY; // header size: 0x20 (0x6C if you count the array afterwards - this is only the header. The array of CALLBACK_ENTRY_ITEMs is useless.)
  11.  
  12. // CALLBACK_ENTRY_ITEM
  13. typedef struct _CALLBACK_ENTRY_ITEM {
  14.     LIST_ENTRY CallbackList; // 0x0
  15.     OB_OPERATION Operations; // 0x10
  16.     DWORD Active; // 0x14
  17.     CALLBACK_ENTRY *CallbackEntry; // 0x18
  18.     PVOID ObjectType; // 0x20
  19.     POB_PRE_OPERATION_CALLBACK PreOperation; // 0x28  this is address of first callback function //
  20.     POB_POST_OPERATION_CALLBACK PostOperation; // 0x30  this is address of second callback function
  21.     QWORD unk1; // 0x38
  22. } CALLBACK_ENTRY_ITEM, *PCALLBACK_ENTRY_ITEM; // size: 0x40
  23.  
  24.  
  25. typedef struct _OBJECT_TYPE {
  26.  LIST_ENTRY TypeList;
  27.  UNICODE_STRING Name;
  28.  VOID* DefaultObject;
  29.  UCHAR Index;
  30.  unsigned __int32 TotalNumberOfObjects;
  31.  unsigned __int32 TotalNumberOfHandles;
  32.  unsigned __int32 HighWaterNumberOfObjects;
  33.  unsigned __int32 HighWaterNumberOfHandles;
  34.  OBJECT_TYPE_INITIALIZER TypeInfo;
  35.  EX_PUSH_LOCK TypeLock;
  36.  unsigned __int32 Key;
  37.  LIST_ENTRY CallbackList; // A linked list of CALLBACK_ENTRY_ITEMs, which is what we want!
  38. }OBJECT_TYPE, *POBJECT_TYPE;
Add Comment
Please, Sign In to add comment