title: OriginalDesiredAccess manipulation in ring0
body: <p>Simple question. I wrote driver (WDM) which hook itself with callback's and intercept virtual memory functions, terminate, suspend end etc (i want to build little self defense). And.. if i try to terminate my app via standard application (without admin rights) - i can't do that, but if i try same thing via application with debug privileges - program successfully terminating. Where my mistake?</p>
  
  <p>Method do detect WriteMemoryProcess:</p>
  
  <pre><code>if ((OperationInformation-&gt;Parameters-&gt;CreateHandleInformation.OriginalDesiredAccess &amp; PROCESS_VM_WRITE) == PROCESS_VM_WRITE)
  {
      OperationInformation-&gt;Parameters-&gt;CreateHandleInformation.DesiredAccess &amp;= ~PROCESS_VM_WRITE;
  }
  </code></pre>
  
  <p>Callback registration:</p>
  
  <pre><code>RegisterOperation.ObjectType = PsProcessType;
  RegisterOperation.Operations = OB_OPERATION_HANDLE_CREATE;
  RegisterOperation.PreOperation = ObjectPreCallback;
  RegisterOperation.PostOperation = ObjectPostCallback;
  RegisterCallBack.Version = OB_FLT_REGISTRATION_VERSION;
  RegisterCallBack.OperationRegistrationCount = registrationCount;
  RtlInitUnicodeString(&amp;Altitude, L"XXXXXXX");
  RegisterCallBack.Altitude = Altitude;
  RegisterCallBack.RegistrationContext = &amp;RegistrationContext;
  RegisterCallBack.OperationRegistration = &amp;RegisterOperation;
  </code></pre>
  
  <p>Thanks for advice!</p>