Kernel Callbacks

PsSetCreateProcessNotifyRoutineEx, PsSetCreateThreadNotifyRoutine, PsSetLoadImageNotifyRoutine, ObRegisterCallbacks, and CmRegisterCallback — the pillars of kernel-mode EDR

Callback Architecture Overview

Kernel Callback Registration Model:

  Driver loads → DriverEntry() registers callbacks:
    PsSetCreateProcessNotifyRoutineEx(MyProcessCallback, FALSE)
    PsSetCreateThreadNotifyRoutine(MyThreadCallback)
    PsSetLoadImageNotifyRoutine(MyImageCallback)
    ObRegisterCallbacks(...)
    CmRegisterCallback(...)

  Callbacks stored in kernel arrays:
    PspCreateProcessNotifyRoutine[]  (64-entry limit)
    PspCreateThreadNotifyRoutine[]   (64-entry limit)
    PspLoadImageNotifyRoutine[]      (8-entry limit)
    ObpCallPreOperationCallbacks[] / ObpCallPostOperationCallbacks[]
    CmpCallCallBacks[] (registry callback list)

  On event:
    Process create  → walk PspCreateProcessNotifyRoutine[] → call each
    Thread create   → walk PspCreateThreadNotifyRoutine[]  → call each
    Image mapped    → walk PspLoadImageNotifyRoutine[]     → call each
    Object access   → call pre-operation → allow/block/modify
    Registry op     → call CmpCallCallBacks callbacks

  Rootkit suppression:
    DKOM: zero out array entries or overwrite with null/NOP
    Bypass limitation: only works on VTL0; HVCI protects kernel code pages

Process Notify Callbacks

PsSetCreateProcessNotifyRoutineEx (the "Ex" version, Windows Vista+) receives a PEPROCESS and PS_CREATE_NOTIFY_INFO struct. It fires on both creation and termination. The driver can block process creation by setting the CreationStatus field to a failure NTSTATUS:

// Registration
VOID MyProcessNotify(
    PEPROCESS           Process,
    HANDLE              ProcessId,
    PPS_CREATE_NOTIFY_INFO CreateInfo)   // NULL on exit
{
    if (CreateInfo == NULL) {
        // Process exiting
        DbgPrint("[EXIT] PID %llu\n", (ULONG64)ProcessId);
        return;
    }

    // Process being created
    if (CreateInfo->ImageFileName) {
        DbgPrint("[CREATE] %wZ PID=%llu ParentPID=%llu\n",
            CreateInfo->ImageFileName,
            (ULONG64)ProcessId,
            (ULONG64)CreateInfo->ParentProcessId);
    }

    // Block process creation: set CreationStatus to error
    // CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;

    // Available fields in PS_CREATE_NOTIFY_INFO:
    //   ParentProcessId    — PID of parent
    //   CreatingThreadId   — TID of thread calling CreateProcess
    //   ImageFileName      — full kernel path (PUNICODE_STRING)
    //   CommandLine        — full command line (PUNICODE_STRING)
    //   FileOpenNameAvailable — set if ImageFileName is reliable
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DrvObj, PUNICODE_STRING RegPath) {
    // ...
    return PsSetCreateProcessNotifyRoutineEx(MyProcessNotify, FALSE);
    // Second param FALSE = register; TRUE = unregister
}

Thread Notify Callbacks

VOID MyThreadNotify(
    HANDLE ProcessId,
    HANDLE ThreadId,
    BOOLEAN Create)    // TRUE=create, FALSE=terminate
{
    if (Create) {
        // Cross-process thread creation: ProcessId != current PID
        // This is the CreateRemoteThread signal at kernel level
        HANDLE currentPid = PsGetCurrentProcessId();
        if (ProcessId != currentPid) {
            DbgPrint("[CROSS-PROC THREAD] Src=%llu Dst=%llu TID=%llu\n",
                (ULONG64)currentPid,
                (ULONG64)ProcessId,
                (ULONG64)ThreadId);
        }
    }
}

// Register:
PsSetCreateThreadNotifyRoutine(MyThreadNotify);

Image Load Notify Callbacks

PsSetLoadImageNotifyRoutine fires when any PE image (EXE or DLL) is memory-mapped into a process. It provides the full image path, process context, and the IMAGE_INFO structure with base address and size. Critical for detecting reflective DLL injection: a reflectively loaded DLL will typically NOT trigger this callback (it allocates memory and manually loads without going through the normal mapped image path):

VOID MyImageNotify(
    PUNICODE_STRING FullImageName,  // kernel path, may be NULL
    HANDLE          ProcessId,
    PIMAGE_INFO     ImageInfo)
{
    // IMAGE_INFO fields:
    //   ImageBase    — VA where image was mapped
    //   ImageSize    — size of mapping
    //   SystemModeImage — set if image loaded into kernel (driver)

    if (ImageInfo->SystemModeImage) {
        // Kernel-mode driver being loaded
        DbgPrint("[DRIVER LOAD] %wZ Base=%p Size=%llu\n",
            FullImageName,
            ImageInfo->ImageBase,
            (ULONG64)ImageInfo->ImageSize);
        return;
    }

    // User-mode DLL loaded into process
    DbgPrint("[DLL LOAD] PID=%llu Base=%p %wZ\n",
        (ULONG64)ProcessId,
        ImageInfo->ImageBase,
        FullImageName);
}

PsSetLoadImageNotifyRoutine(MyImageNotify);

Object Callbacks (ObRegisterCallbacks)

Object callbacks intercept attempts to open handles to processes, threads, or desktop objects. They fire in both pre-operation (before access check) and post-operation (after handle is created) contexts. EDRs use object callbacks to strip sensitive access rights from handles granted to suspicious processes, implementing "handle stripping" — even if malware tries OpenProcess(PROCESS_ALL_ACCESS, ..., lsass), the object callback can reduce the rights to something that makes credential dumping fail:

// Object callback for process handles — strip memory-read rights
OB_PREOP_CALLBACK_STATUS PreOperationCallback(
    PVOID                          RegistrationContext,
    POB_PRE_OPERATION_INFORMATION  OperationInformation)
{
    if (OperationInformation->ObjectType != *PsProcessType)
        return OB_PREOP_SUCCESS;

    // Get target process
    PEPROCESS target = (PEPROCESS)OperationInformation->Object;
    HANDLE targetPid = PsGetProcessId(target);

    // Check if target is a protected process (e.g., lsass)
    if (IsProtectedProcess(targetPid)) {
        // Strip dangerous access rights from the handle
        ACCESS_MASK deniedRights =
            PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION |
            PROCESS_DUP_HANDLE | PROCESS_SUSPEND_RESUME;

        if (OperationInformation->Operation == OB_OPERATION_HANDLE_CREATE) {
            OperationInformation->Parameters->CreateHandleInformation
                .DesiredAccess &= ~deniedRights;
        } else { // OB_OPERATION_HANDLE_DUPLICATE
            OperationInformation->Parameters->DuplicateHandleInformation
                .DesiredAccess &= ~deniedRights;
        }
    }
    return OB_PREOP_SUCCESS;
}

// Registration structure
OB_OPERATION_REGISTRATION opReg = {
    .ObjectType         = PsProcessType,
    .Operations         = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE,
    .PreOperation       = PreOperationCallback,
    .PostOperation      = NULL
};
OB_CALLBACK_REGISTRATION cbReg = {
    .Version            = OB_FLT_REGISTRATION_VERSION,
    .OperationRegistrationCount = 1,
    .Altitude           = RTL_CONSTANT_STRING(L"321000"),
    .RegistrationContext= NULL,
    .OperationRegistration = &opReg
};
ObRegisterCallbacks(&cbReg, &g_ObHandle);

Registry Callbacks (CmRegisterCallback)

CmRegisterCallback registers a kernel function that fires on every registry operation (open, create, delete, query, set value). Each operation has a pre- and post-notification version. Registry callbacks are used by security products to monitor and block registry modifications that indicate persistence:

NTSTATUS RegistryCallback(
    PVOID  CallbackContext,
    PVOID  Argument1,    // REG_NOTIFY_CLASS enum value
    PVOID  Argument2)    // operation-specific struct
{
    REG_NOTIFY_CLASS notifyClass = (REG_NOTIFY_CLASS)Argument1;

    switch (notifyClass) {
    case RegNtPreSetValueKey: {
        PREG_SET_VALUE_KEY_INFORMATION info =
            (PREG_SET_VALUE_KEY_INFORMATION)Argument2;
        DbgPrint("[REG SET] %wZ\n", info->ValueName);
        // Could inspect info->Data, info->DataSize, info->Type
        // Return STATUS_ACCESS_DENIED to block the write
        break;
    }
    case RegNtPreCreateKey: {
        PREG_CREATE_KEY_INFORMATION info =
            (PREG_CREATE_KEY_INFORMATION)Argument2;
        DbgPrint("[REG CREATE] %wZ\n", info->CompleteName);
        break;
    }
    default:
        break;
    }
    return STATUS_SUCCESS;  // SUCCESS = allow; error = block
}

LARGE_INTEGER g_CmCookie;
CmRegisterCallback(RegistryCallback, NULL, &g_CmCookie);

Callback Suppression (Rootkit Technique)

PspCreateProcessNotifyRoutine[] array structure (simplified):

  [0] = 0xFFFFF80012340001  (low bit set = EX_CALLBACK_ROUTINE_BLOCK)
  [1] = 0xFFFFF80056780001  (another registered callback)
  [2] = 0x0000000000000000  (empty slot)
  ...
  [63]= 0x0000000000000000

  Rootkit DKOM suppression:
    1. Find PspCreateProcessNotifyRoutine array (via signature scan in ntoskrnl)
    2. Read each non-zero entry
    3. Clear the low bit → get pointer to EX_CALLBACK_ROUTINE_BLOCK
    4. From that block, get function pointer
    5. Compare to target EDR driver base range → zero out the entry

  Result: EDR's process creation callback silently removed.
  EDR sees no notification of any new process creation.

  PspCreateThreadNotifyRoutine[] — same structure, same attack
  PspLoadImageNotifyRoutine[]    — same structure, 8 entries max

Q & A