IopInitializeSessionNotifications
NTSTATUS __stdcall IopInitializeSessionNotifications(){
_UNICODE_STRING DestinationString;
_OBJECT_ATTRIBUTES ObjectAttributes;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
*(&stru_140C452E0 + 119) = 0i64;
*(&stru_140C452E0 + 121) = (char *)&stru_140C452E0 + 960;
DestinationString = 0i64;
*(&stru_140C452E0 + 120) = (char *)&stru_140C452E0 + 960;
RtlInitUnicodeString(&DestinationString, L"\\Callback\\IoSessionNotifications");
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 80;
ObjectAttributes.ObjectName = &DestinationString;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
return ExCreateCallback((PCALLBACK_OBJECT *)&stru_140C452E0 + 102, &ObjectAttributes, 1u, 1u);
}Referenced by:
IoInitSystemPreDrivers