The PsSetLoadImageNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded (or mapped into memory).
NTKERNELAPI NTSTATUS PsSetLoadImageNotifyRoutineEx( PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine, ULONG_PTR Flags );
A pointer to the caller-implemented PLOAD_IMAGE_NOTIFY_ROUTINE callback routine for load-image notifications.
Supplies a bitmask of flags that control the callback function. Here are the possible values:
- PS_IMAGE_NOTIFY_CONFLICTING_ARCHITECTURE indicates that the callback routine should be invoked for all potentially executable images, including images that have a different architecture from the native architecture of the operating system.
||The callback was successfully registered.|
||Invalid flag was supplied in Flags.|
||The routine failed allocate a callback block due to lack of resources.|
|Windows version||Windows 10, version 1709 Windows Server 2016|
|DLL||NtosKrnl.exe (kernel mode)|