#include<ntddk.h>
HANDLE hTimeCallBack;
//时间回调运行在DISPATCH_LEVEL
VOID
TimeCallBackRoutine (
IN PVOID CallbackContext,
IN PVOID Argument1,
IN PVOID Argument2
)
{
KdPrint(("运行时间回调,当前IRQL=%d\n",KeGetCurrentIrql()));
}
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
if (hTimeCallBack)
{
ExUnregisterCallback(hTimeCallBack);
}
KdPrint(("驱动卸载成功\n"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
NTSTATUS status =STATUS_SUCCESS;
pDriverObject->DriverUnload=DriverUnload;
UNICODE_STRING CbName = RTL_CONSTANT_STRING(L"\\CallBack\\SetSystemTime");
OBJECT_ATTRIBUTES oa;
PCALLBACK_OBJECT CallBack;
InitializeObjectAttributes(&oa,&CbName,OBJ_CASE_INSENSITIVE,NULL,NULL);
status = ExCreateCallback(&CallBack, &oa, TRUE, FALSE);
if(!NT_SUCCESS(status))
{
KdPrint(("创建回调失败\n"));
return status;
}
hTimeCallBack=ExRegisterCallback(CallBack, TimeCallBackRoutine, NULL);
if (!hTimeCallBack)
{
KdPrint(("时间变更回调函数注册失败\n"));
}
//成功注册后,需要调用这个函数来清理.不然会内存泄漏
ObDereferenceObject(CallBack);
return status;
}
时间变更回调
最新推荐文章于 2022-07-05 14:53:07 发布