PsSetLoadImageNotifyRoutine回调列子

#include 

VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE  ProcessId, PIMAGE_INFO  ImageInfor);
NTSTATUS	Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("unload driver");
	PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
	return STATUS_SUCCESS;
}

VOID UnicodeToChar(PUNICODE_STRING uniSource, CHAR *szDest)
{
	ANSI_STRING ansiTemp;
	RtlUnicodeStringToAnsiString(&ansiTemp, uniSource, TRUE);

	strcpy(szDest, ansiTemp.Buffer);
	RtlFreeAnsiString(&ansiTemp);
}

VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE  ProcessId, PIMAGE_INFO  ImageInfor)
{
	PVOID DriverEntryAddress = NULL;
	char szFullImageName[260] = { 0 };

	if (ProcessId)
	{
		UnicodeToChar(FullImageName, szFullImageName);
		//        DbgPrint("FullImageName:%s\r\n",szFullImageName);
		
		DbgPrint("%s LoadImage\r\n",szFullImageName);
		
	}
}




NTSTATUS	DriverEntry(PDRIVER_OBJECT	driver, PUNICODE_STRING	RegPath)
{
	DbgPrint("Driver Entry");
	driver->DriverUnload = Unload;

	PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)LoadImageNotifyRoutine);
	return STATUS_SUCCESS;
}