Geoff Chappell - Software Analyst
SKETCH OF HOW RESEARCH MIGHT CONTINUE AND RESULTS BE PRESENTED
The OB_PARSE_METHOD type is a pointer to a routine that can be defined for all objects of the same type. It is specified as the ParseProcedure member of the OBJECT_TYPE_INITIALIZER structure when creating the object type. It is then retained in this structure as nested into the OBJECT_TYPE structure.
typedef
NTSTATUS
(*OB_PARSE_METHOD) (
PVOID ParseObject,
PVOID ObjectType,
ACCESS_STATE *AccessState,
KPROCESSOR_MODE AccessMode,
ULONG Attributes,
UNICODE_STRING *CompleteName,
UNICODE_STRING *RemainingName,
PVOID Context,
SECURITY_QUALITY_OF_SERVICE *SecurityQos,
PVOID *Object);