“How do I disable obregistercallback for a another kernel driver in windows? Rather than outright removing it?”

Another soul answered...

Idk man I ain’t a specialist in this

Another soul answered...

I diânt understand your question. Hi from Brazil :)

Another soul answered...

the goog told me Visión general creada por IA In Windows, ObRegisterCallbacks registers a set of callbacks for object creation or duplication (like process or thread handle creation), which security drivers (EDR/Antivirus) use to protect their processes.To "disable" or bypass these callbacks for another kernel driver without outright removing the callback structure from the list (which would trigger PatchGuard if not done carefully), kernel developers and security researchers typically look at how the callback system operates.From a defensive and OS-internals perspective, here is how the mechanism works and how drivers interact with it:1. The Underlying MechanismWhen a driver calls ObRegisterCallbacks, the system allocates a structure (often referred to internally as OB_CALLBACK_ENTRY_ITEM or part of the CallbackList head on the object type, like PsProcessType).Each registered callback item contains:A pointer to the Pre-operation callback function.A pointer to the Post-operation callback function.An Altitude string or value determining execution order.A version and operation bits.2. Disabling vs. Removing (Internal Concepts)If a tool or driver wants to neutralize a callback without unregistering it (removing it from the doubly-linked list), it generally uses one of two conceptual methods:Method A: Patching the Callback Function Pointers (Nullifying)Instead of unlinking the entry from the CallbackList (which can cause stability issues if another thread is walking the list), some techniques involve modifying the pointers inside the callback structure.How it works: The driver locates the specific callback entry for the target driver in memory and replaces the function pointers (PreAnalyze or PostAnalyze) with a pointer to a dummy function that simply returns OB_PREOP_SUCCESS or does nothing.The Trapdoor: Modifying these structures or the code they point to can trigger PatchGuard (KPP - Kernel Patch Protection). PatchGuard monitors critical system structures and driver images. If it detects unauthorized modifications to object type structures or protected pool allocations, it will bugcheck the system (BSOD).Method B: Changing the Callback Registration FlagsEach callback entry has flags or parameters defining what events it hooks (e.g., OB_OPERATION_HANDLE_CREATE). Theoretically, if the operation flags are cleared or masked out, the dispatcher skips executing the callback for those operations. However, these structures are undocumented and vary between Windows versions, making this highly unstable.Defensive Mitigation & PreventionBecause tampering with kernel callbacks is a common tactic used by rootkits to blind security software, Windows and EDRs employ several defenses:Driver Signature Enforcement (DSE): Windows requires all kernel-mode drivers to be digitally signed by a trusted authority, preventing arbitrary code from executing at the kernel level to manipulate these structures.PatchGuard: Periodically validates that the object type callback lists and kernel structures have not been tampered with.Self-Protection: Modern EDR drivers monitor modifications to their own loaded image space and critical structures in memory, treating attempts to modify their callback pointers as a malicious event.To help narrow down the context, are you developing a security driver that needs to coordinate with other drivers, or are you debugging/analyzing a specific conflict between two third-party drivers?