EtwpInitializePrivateSessionDemuxObject
NTSTATUS __stdcall EtwpInitializePrivateSessionDemuxObject(){
_UNICODE_STRING DestinationString;
_OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
DestinationString = 0i64;
memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
ObjectTypeInitializer._bf_0 |= 0x14u;
ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))EtwpOpenRealTimeConnectionObject;
ObjectTypeInitializer.Length = 120;
ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))EtwpDeleteSessionDemuxObject;
ObjectTypeInitializer.InvalidAttributes = 256;
ObjectTypeInitializer.GenericMapping = EtwpGenericMapping;
ObjectTypeInitializer.PoolType = PagedPool;
ObjectTypeInitializer.DefaultPagedPoolCharge = 32;
RtlInitUnicodeString(&DestinationString, L"EtwSessionDemuxEntry");
return ObCreateObjectTypeEx(&DestinationString, &ObjectTypeInitializer, 0i64, 0i64, &EtwpSessionDemuxObjectType);
}Referenced by:
EtwpInitialize