Skip to content

Files

Latest commit

Nov 6, 2019
4798be7 · Nov 6, 2019

History

History

WdNriNotificationCallback

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
Nov 6, 2019
Nov 6, 2019

WdNriNotificationCallback

Description

The callback object can be created in 2 places: WdFilter.sys and WdNisDrv.sys. But a callback function is registered only in WdFilter.sys, last time we checked the callback was named MpNriNotificationCallback. The callback in itself isn't very interesting and in essence is just a wrapper around MpRefreshProcessNotifications, which we already sketched in WdProcessNotificationCallback. Callback's code is provided just as a future reference:

callback

We observed that this callback object is notified from WdNisDrv.sys - set_process_exceptions(PMP_DATA , PIRP *).

callback_notif