#include "load_Image_callback.h" namespace load_image_notify_routine { VOID load_image_notify_routine( PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo ) { UNREFERENCED_PARAMETER(ProcessId); UNREFERENCED_PARAMETER(ImageInfo); if(FullImageName->Buffer) DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer); } auto create_image_load_notify_routine() -> NTSTATUS { return PsSetLoadImageNotifyRoutine(load_image_notify_routine); } auto remove_image_load_notify_routine() -> NTSTATUS { return PsRemoveLoadImageNotifyRoutine(load_image_notify_routine); } }