This question has been previously posted but I did not see a complete answer
to it.
My callback routine registered with PsSetLoadImageNotifyRoutine, needs a
fully qualified pathname to the image that is being loaded.
This works fine for EXEs. For example if I run cmd.exe, I receive the
following image name:
“\Device\HarddiskVolume2\WINDOWS\system32\cmd.exe”
However, when dependent DLLs are loaded I get a partial path. For example:
“\WINDOWS\system32\kernel32.dll”
The only suggested approach has been to parse the PEB for the image name,
but I would prefer to not use an undocumented structure. In addition, my initial implementation showed a list that: 1) used drive letters; 2) included every imageloaded so far but not the one that was currently being loaded (i.e., the one I wanted).
Thanks,
Patrick