IDkmHiddenEntryPointNotification Interface

Definition

IDkmHiddenEntryPointNotification is implemented by components that want to listen for the HiddenEntryPoint event. IDkmHiddenEntryPointNotification is invoked after all implementations of IDkmHiddenEntryPointReceived. When this notification is called, the target process is stopped and implementers are able to either inspect the process or cause it to execute in a controlled manner (slip, func-eval).

Fired from the breakpoint manager when the entry point breakpoint has been hit in hidden code. The actual EntryPoint is delayed until we leave hidden code, and might not even be fired if we're unable to find an appropriate opening. The HiddenEntryPoint will be fired in addition for any behind-the-scenes work necessary.

HiddenEntryPoint events cannot be suppressed. To override the entry point, implement IDkmHiddenEntryPointQuery.

Implementations of this interface may restrict when they are called using a filter defined in their component configuration. The following properties may be used: BaseDebugMonitorId, EngineId, TransportKind.

This API was introduced in Visual Studio 14 RTM (DkmApiVersion.VS14RTM).

public interface class IDkmHiddenEntryPointNotification
public interface class IDkmHiddenEntryPointNotification
__interface IDkmHiddenEntryPointNotification
public interface IDkmHiddenEntryPointNotification
type IDkmHiddenEntryPointNotification = interface
Public Interface IDkmHiddenEntryPointNotification

Methods

OnHiddenEntryPoint(DkmProcess, DkmThread, DkmEventDescriptor)

OnHiddenEntryPoint is invoked as part of event processing. See interface definition for more information.

Applies to