Hello all,
I’m registering a callback using PsSetLoadImageNotifyRoutine.
Obviously the ImageBase of the ImageInfo parameter to the callback points
to a loaded PE image (I’ve checked that it starts with the DOS header).
My question is whether the relocations of RVAs have been done in this
image, or if those are relocated after the callback has returned.
The latter would be the ideal situation for me, and I haven’t yet
encountered a counterexample to that, but of course it might be that the
images just happen to get loaded at their prefered base adresses.
Thanks in advance,
Thomas Drakengren
Carlstedt Research & Technology, www.crt.se
Gothenburg, Sweden