I have read on this forum (and some other places also) that loading of image files can be blocked in IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION.
I am returning STATUS_ACCESS_DENIED in processing of this IRP. This works fine with exes and prevents creation of corresponding process. However when I tried this with dlls, it showed confusing results.
I checked using procmon and vmmap. In procmon, I get ACCESS_DENIED as result, for FASTIO_ACQUIRE_FOR_SECTION_SYNCHRONIZATION. But in vmmap, the blocked dll was shown as mapped into address space of the process. That means even though the IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION was successfully blocked by my driver, still the image file got loaded into address space of a process.
Does this mean, that this IRP cannot be used to block loading of image files into memory? I am confused about the use and purpose of this IRP. Is there any documentation that clarifies this IRP ?