Edit

IMAGE_INFO structure (ntddk.h)

  • Article

The IMAGE_INFO structure is used by driver's load-image routine (PLOAD_IMAGE_NOTIFY_ROUTINE) to specify load image information.

Syntax

typedef struct _IMAGE_INFO {
  union {
    ULONG Properties;
    struct {
      ULONG ImageAddressingMode : 8;
      ULONG SystemModeImage : 1;
      ULONG ImageMappedToAllPids : 1;
      ULONG ExtendedInfoPresent : 1;
      ULONG MachineTypeMismatch : 1;
      ULONG ImageSignatureLevel : 4;
      ULONG ImageSignatureType : 3;
      ULONG ImagePartialMap : 1;
      ULONG Reserved : 12;
    };
  };
  PVOID  ImageBase;
  ULONG  ImageSelector;
  SIZE_T ImageSize;
  ULONG  ImageSectionNumber;
} IMAGE_INFO, *PIMAGE_INFO;

Members

Properties

Represents all the bit values within the structure that Properties is unioned with.

ImageAddressingMode

Always set to IMAGE_ADDRESSING_MODE_32BIT.

SystemModeImage

Set either to one for newly loaded kernel-mode components, such as drivers, or to zero for images that are mapped into user space.

ImageMappedToAllPids

Always set to zero.

ExtendedInfoPresent

If the ExtendedInfoPresent flag is set, IMAGE_INFO is a part of IMAGE_INFO_EX. Added in Windows Vista.

MachineTypeMismatch

Always set to zero. Added in Windows 8/Windows Server 2012.

ImageSignatureLevel

The level of signature with which code integrity has labeled the image. This value is one of the #define SE_SIGNING_LEVEL_* constants in ntddk.h. Added in Windows 8.1/Windows Server 2012 R2.

ImageSignatureType

The type of signature with which code integrity has labeled the image. This value is a SE_IMAGE_SIGNATURE_TYPE enumeration value, defined in ntddk.h. Added in Windows 8.1/Windows Server 2012 R2.

ImagePartialMap

This value is non-zero if the image mapping view called out for is a partial view that does not map the entire image; 0 if the view maps the entire image. Added in Windows 10/Windows Server 2016.

Reserved

Always set to zero.

ImageBase

Set to the virtual base address of the image.

ImageSelector

Always set to zero.

ImageSize

Set to the virtual size, in bytes, of the image.

ImageSectionNumber

Always set to zero.

Remarks

If the ExtendedInfoPresent flag is set, the IMAGE_INFO structure is part of IMAGE_INFO_EX, which is a larger, extended version of the image information structure. In this case, the load-image notify routine can use the CONTAINING_RECORD macro (in miniport.h) to obtain the base address of the IMAGE_INFO_EX structure.

Requirements

Requirement Value
Header ntddk.h (include Ntddk.h)

See also

IMAGE_INFO_EX

PLOAD_IMAGE_NOTIFY_ROUTINE

PsSetLoadImageNotifyRoutine