Best way to block an Image load in a process from?

[brad_H]

There was a previous discussion about this years ago, but with no proper solution:

Blocking a image from loading

I am writing a mini filter driver which monitors the loading of images(ex:dll files, sys files). For this purpose I registered a LoadImageNotifyRoutine using PSsetLoadImageNotifyRoutine. In LoadImageNotifyRoutine I need to block some dll files from loading. How this thing can be done using LoadImageNotifyRoutine? LoadImageNotifyRoutine is having 3 parameters they are 1.FullImageName, 2. ProcessId, // where image is mapped 3. ImageInfo ImageInfo of type PIMAGE_INFO. If it is not possible to b…

My question is, assume I want to only allow certain validated modules (dlls, etc) from being able to get loaded in my protected process, what is the best way to achieve this? So for example only DLLs signed with a proper digital signature (Microsoft or else) can get loaded in the protected process.

Because PsSetLoadImageNotifyRoutine doesn't provide a way for blocking a module from loading, so what is the alternative approach?

[DymOK93]

@brad_H

so what is the alternative approach?

Minifilter callbacks for IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION (pseudo-IRP) or IRP_MJ_CREATE