PsSetLoadImageNotifyRoutineEx function

The PsSetLoadImageNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded (or mapped into memory).

Syntax

NTKERNELAPI NTSTATUS PsSetLoadImageNotifyRoutineEx(
  PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine,
  ULONG_PTR                  Flags
);

Parameters

NotifyRoutine

A pointer to the caller-implemented PLOAD_IMAGE_NOTIFY_ROUTINE callback routine for load-image notifications.

Flags

Supplies a bitmask of flags that control the callback function. Here are the possible values:

  • PS_IMAGE_NOTIFY_CONFLICTING_ARCHITECTURE indicates that the callback routine should be invoked for all potentially executable images, including images that have a different architecture from the native architecture of the operating system.

Return Value

Return code Description
STATUS_SUCCESS
The callback was successfully registered.
STATUS_INVALID_PARAMETER_2
Invalid flag was supplied in Flags.
STATUS_INSUFFICIENT_RESOURCES
The routine failed allocate a callback block due to lack of resources.

Requirements

   
Windows version Windows 10, version 1709 Windows Server 2016
Target Platform Windows
Header ntddk.h
Library NtosKrnl.lib
DLL NtosKrnl.exe (kernel mode)
IRQL PASSIVE_LEVEL