please teach me

[hfiref0x]

please teach me

[hfiref0x]

PsSetCreateProcessNotifyRoutine now is just a wrapper for PspSetCreateProcessNotifyRoutine, the same as PsSetCreateProcessNotifyRoutineEx, previously in Vista/XP times AFAIR it wasn't implemented that way. Inside it calls MmVerifyCallbackFunctionCheckFlags which check if driver is loaded and code is compiled with /INTEGRITYCHECK linker setting. First check accomplished by walking loaded modules list (KLDR_DATA_TABLE_ENTRY) and looking for address of supplied notify routine to be in range of one of the loaded modules. If it found then KLDR_DATA_TABLE_ENTRY->Flag checked against 0x20 value. In case of any error STATUS_ACCESS_DENIED will be returned.

You need to manually set this flag for your DriverObject->DriverSection->Flags. To bypass loaded module list check just search in google for various solutions. Most of them advising to use trampoline jump set somewhere in the innocent legit driver, so MmVerifyCallbackFunctionCheckFlags will validate legit driver instead of your mapped one. For example you can load Process Explorer driver, overwrite it driver dispatch with your small trampoline which will just jump to your real notify handler and install notify routine by supplying address of ProcessExplorer ovewritten code.

[xxTree]

Thank you for answering, there is another question, why do I use WskRegister() in ksocket to cause a BSOD? Thanks~

[hfiref0x]

I've no idea since I don't know how do you call it and what is your environment. And this is not a KDU issue.