I’m using ObRegisterCallbacks to block read/write into the process and inject any DLL files. I have a couple of custom DLL files which load into the process automatically, can I somehow allow to load this DLL files?
ObRegisterCallbacks can block the handle creation to this process - It does not block the actual DLL load.
If it is a process you “own”, you can simply use the regular DLL loading mechanisms to load the DLL into this process.
If it’s not a process you own, it depends on what you’re trying to achieve… You can allow certain “known” processes to open a handle in your callback for example…