An application passes a custom function in the form of a callback Hook (from <utility/hooks.h>): struct Hook { struct MinNode h_MinNode; ULONG (*h_Entry)(); /* stub function entry point */ ULONG (*h_SubEntry)(); /* the custom function entry point */ VOID *h_Data; /* owner specific */ }; h_MinNode This field is reserved for use by the module that will call the Hook. h_Entry This is the address of the Hook stub. When the OS calls a callback function, it puts parameters for the callback function in CPU registers A0, A1, and A2. This makes it tough for higher level language programmers to use a callback function because most higher level languages don't have a way to manipulate CPU registers directly. The solution is a stub function which first copies the parameters from the CPU registers to a place where a high level language function can get to them. The stub function then calls the callback function. Typically, the stub pushes the registers onto the stack in a specific order and the callback function pops them off the stack. h_SubEntry This is the address of the actual callback function that the application has defined. The stub calls this function. h_Data This field is for the application to use. It could point to a global storage structure that the callback function utilizes. There is only one function defined in utility library that relates to callback hooks: ULONG CallHookPkt(struct Hook *hook, VOID *object, VOID *paramPkt); This function calls a standard callback Hook function. simple callback hook usage