31 lines
613 B
C++
31 lines
613 B
C++
#include "load_Image_callback.h"
|
|
|
|
namespace load_image_notify_routine
|
|
{
|
|
VOID load_image_notify_routine(
|
|
PUNICODE_STRING FullImageName,
|
|
HANDLE ProcessId,
|
|
PIMAGE_INFO ImageInfo
|
|
)
|
|
{
|
|
UNREFERENCED_PARAMETER(ProcessId);
|
|
UNREFERENCED_PARAMETER(ImageInfo);
|
|
|
|
if(FullImageName->Buffer)
|
|
DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer);
|
|
|
|
}
|
|
|
|
|
|
|
|
auto create_image_load_notify_routine() -> NTSTATUS
|
|
{
|
|
return PsSetLoadImageNotifyRoutine(load_image_notify_routine);
|
|
}
|
|
auto remove_image_load_notify_routine() -> NTSTATUS
|
|
{
|
|
return PsRemoveLoadImageNotifyRoutine(load_image_notify_routine);
|
|
}
|
|
}
|
|
|