IopInitializeSessionNotifications
NTSTATUS __fastcall IopInitializeSessionNotifications(INT64 a1, INT64 a2, WCHAR a3){
struct _UNICODE_STRING DestinationString;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
IopSessionNotificationLock = 0i64;
qword_140C456A8 = (__int64)&IopSessionNotificationQueueHead;
DestinationString = 0i64;
IopSessionNotificationQueueHead = &IopSessionNotificationQueueHead;
RtlInitUnicodeString(&DestinationString, L"\\Callback\\IoSessionNotifications", a3);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 80;
ObjectAttributes.ObjectName = &DestinationString;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
return ExCreateCallback((PCALLBACK_OBJECT *)IopSessionCallbackObject, &ObjectAttributes, 1u, 1u);
}Referenced by:
IoInitSystemPreDrivers