时间变更回调

#include<ntddk.h>
HANDLE hTimeCallBack;

//时间回调运行在DISPATCH_LEVEL
VOID
TimeCallBackRoutine (
IN PVOID CallbackContext,
IN PVOID Argument1,
IN PVOID Argument2
)
{
	KdPrint(("运行时间回调,当前IRQL=%d\n",KeGetCurrentIrql()));
}
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	if (hTimeCallBack)
	{
		ExUnregisterCallback(hTimeCallBack);
	}
	KdPrint(("驱动卸载成功\n"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status =STATUS_SUCCESS;
	pDriverObject->DriverUnload=DriverUnload;

	UNICODE_STRING CbName = RTL_CONSTANT_STRING(L"\\CallBack\\SetSystemTime");
	OBJECT_ATTRIBUTES oa;
	PCALLBACK_OBJECT CallBack;
	InitializeObjectAttributes(&oa,&CbName,OBJ_CASE_INSENSITIVE,NULL,NULL);
	status = ExCreateCallback(&CallBack, &oa, TRUE, FALSE);
		if(!NT_SUCCESS(status))
		{
			KdPrint(("创建回调失败\n"));
			return status;
		}

	hTimeCallBack=ExRegisterCallback(CallBack, TimeCallBackRoutine, NULL);
	if (!hTimeCallBack)
	{
		KdPrint(("时间变更回调函数注册失败\n"));
	}
	//成功注册后,需要调用这个函数来清理.不然会内存泄漏
	ObDereferenceObject(CallBack);
	return status;

}