PsSetLoadImageNotifyRoutineEx function

The PsSetLoadImageNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded (or mapped into memory).

Syntax

NTSTATUS PsSetLoadImageNotifyRoutineEx(
  PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine,
  ULONG_PTR                  Flags
);

Parameters

NotifyRoutine

A pointer to the caller-implemented PLOAD_IMAGE_NOTIFY_ROUTINE callback routine for load-image notifications.

Flags

Supplies a bitmask of flags that control the callback function. Here are the possible values:

  • PS_IMAGE_NOTIFY_CONFLICTING_ARCHITECTURE indicates that the callback routine should be invoked for all potentially executable images, including images that have a different architecture from the native architecture of the operating system.

Return Value

Return code Description
STATUS_SUCCESS
The callback was successfully registered.
STATUS_INVALID_PARAMETER_2
Invalid flag was supplied in Flags.
STATUS_INSUFFICIENT_RESOURCES
The routine failed allocate a callback block due to lack of resources.

Requirements

   
Minimum supported client Windows 10, version 1709
Minimum supported server Windows Server 2016
Target Platform Windows
Header ntddk.h
Library NtosKrnl.lib
DLL NtosKrnl.exe (kernel mode)
IRQL PASSIVE_LEVEL