triplefault.io

Most people are familiar with the fact that Windows contains a wide variety of kernel-mode callback routines that driver developers can opt into to receive various event notifications. This blog post will explain exactly how some of these function under the hood. In particular, we'll investigate how the process creation and termination callbacks ( nt!PsSetCreateProcessNotifyRoutine , nt!PsSetCreateProcessNotifyRoutineEx , and nt!PsSetCreateProcessNotifyRoutineEx2 ), thread creation and termination callbacks ( nt!PsSetCreateThreadNotifyRoutine and nt!PsSetCreateThreadNotifyRoutineEx ), and image load notification callbacks ( nt!PsSetLoadImageNotifyRoutine ) work internally. Furthermore, we'll release a handy WinDbg script that will let you enumerate these different types of callbacks.

This blog post will go over an assumption made over a decade ago by Microsoft when dealing with software breakpoints that can be used to reveal the presence of most (all publicly available?) usermode and kernelmode debuggers.