The PsSetLoadImageNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded (or mapped into memory).
NTSTATUS PsSetLoadImageNotifyRoutineEx( PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine, ULONG_PTR Flags );
A pointer to the caller-implemented PLOAD_IMAGE_NOTIFY_ROUTINE callback routine for load-image notifications.
Supplies a bitmask of flags that control the callback function. Here are the possible values:
- PS_IMAGE_NOTIFY_CONFLICTING_ARCHITECTURE indicates that the callback routine should be invoked for all potentially executable images, including images that have a different architecture from the native architecture of the operating system.
||The callback was successfully registered.|
||Invalid flag was supplied in Flags.|
||The routine failed allocate a callback block due to lack of resources.|
|Minimum supported client||Windows 10, version 1709|
|Minimum supported server||Windows Server 2016|
|DLL||NtosKrnl.exe (kernel mode)|
We'd love to hear your thoughts. Choose the type you'd like to provide:
Our feedback system is built on GitHub Issues. Read more on our blog.