// DriverEntry if(!NT_SUCCESS(PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine))) { KdPrint(("PsSetLoadImageNotifyRoutine Failed!\n")); } // DriverUnload if(!NT_SUCCESS(PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine))) { KdPrint(("PsRemoveLoadImageNotifyRoutine Failed!\n")); } // LoadImageNotifyRoutine VOID LoadImageNotifyRoutine( __in_opt PUNICODE_STRING FullImageName, __in HANDLE ProcessId, __in PIMAGE_INFO ImageInfo ) { KdPrint(("LoadImageNotifyRoutine\n")); // The FullImageName parameter can be NULL in cases in which the operating system is unable to obtain the full name of the image at process creation time. if(FullImageName != NULL) { KdPrint(("FullImageName = %wZ\n", FullImageName)); } // The ProcessId handle identifies the process in which the image has been mapped, but this handle is zero if the newly loaded image is a driver. KdPrint(("ProcessId = %u\n", ProcessId)); KdPrint(("ImageInfo->SystemModeImage = %u\n", ImageInfo->SystemModeImage)); KdPrint(("ImageInfo->ImageBase = %08x\n", ImageInfo->ImageBase)); KdPrint(("ImageInfo->ImageSize = %u\n", ImageInfo->ImageSize)); }