Skip to content

Kernel Callbacks

Jump to bottom
NeverSightAI edited this page Jul 16, 2026 · 2 revisions

Kernel Callbacks

Windows notify/object registration APIs used by anti-cheat and EDR to observe process/thread creation, image loads, handle operations, registry, and file I/O.

Common APIs

  • PsSetCreateProcessNotifyRoutine(Ex/2), PsSetCreateThreadNotifyRoutine(Ex)
  • PsSetLoadImageNotifyRoutine(Ex)
  • ObRegisterCallbacks (handle create/duplicate)
  • CmRegisterCallback(Ex), minifilter FltRegisterFilter

Attack / defense

Attackers with kernel R/W (BYOVD) may try to unlink or patch callback lists; hypervisor EPT write-protection is a modern counter. EFI/bootkits can avoid some load-image signals entirely.

Related

BYOVD · HVCI · Vanguard · Windows Kernel · Anti-Cheat

awesome-game-security · gs.awesome.rip · Wiki mirrors the in-repo knowledge layer under wiki/

Home

Guides

Topics

Reference

External

Clone this wiki locally