I have observed that callback functions that are registered with PsSetLoadImageNotifyRoutine are called with the current process lock acquired (which is a fast mutex in XP). That is, the callback cannot call many of the process related functions because of the acquired mutex. Not counting it works at APC level.
I suppose this is made on purpose, but I wonder why it is done that way? Is it precisely to prevent callbacks calling these functions ?
At least it should be documented I think.
Inaki.