feat image load

2026-06-01 09:20:02 +08:00
parent 4bf9a42170
commit 93417ef728
6 changed files with 64 additions and 4 deletions
@@ -0,0 +1,30 @@
+#include "load_Image_callback.h"
+
+namespace load_image_notify_routine
+{
+	VOID load_image_notify_routine(
+		PUNICODE_STRING FullImageName,
+		HANDLE ProcessId,
+		PIMAGE_INFO ImageInfo
+	)
+	{	
+		UNREFERENCED_PARAMETER(ProcessId);
+		UNREFERENCED_PARAMETER(ImageInfo);
+
+		if(FullImageName->Buffer)
+			DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer);
+		
+	}
+
+
+
+	auto create_image_load_notify_routine() -> NTSTATUS
+	{
+		return PsSetLoadImageNotifyRoutine(load_image_notify_routine);
+	}
+	auto remove_image_load_notify_routine() -> NTSTATUS
+	{
+		return PsRemoveLoadImageNotifyRoutine(load_image_notify_routine);
+	}
+}
+