次の方法で共有


CEL_MODULE_FREE (Compact 2013)

3/28/2014

This structure identifies a module that was loaded.

Syntax

typedef __CEL_MODULE_FREE {
  HANDLE hProcess;
  HANDLE hModule;
} CEL_MODULE_FREE, *PCEL_MODULE_FREE;

Members

  • hProcess
    Handle of the process that freed the module.

    In Windows CE 5.0, if this field is INVALID_HANDLE_VALUE (0xFFFFFFFF), the event indicates that the module was unloaded for the last time. After this event, no instances of the module are loaded by any process.

  • hModule
    Handle of the freed module.

Remarks

In Windows CE 5.0, CEL_MODULE_FREE is logged each time a process unloads the module for the last time.

If several processes load and then unload the module, one CEL_MODULE_FREE event is logged for each process.

When a process is the last process to unload a module, the kernel logs two CEL_MODULE_FREE structures:

  • A CEL_MODULE_FREE structure is logged with an hProcess value set to the handle of the last process to unload the module.
  • Another CEL_MODULE_FREE structure is logged with an hProcess value set to INVALID_HANDLE_VALUE to indicate that the module is being unloaded for the last time by any process.

If any process unloads the module more than once, only one CEL_MODULE_FREE event is logged for that process.

Requirements

Header

celog.h

See Also

Reference

CeLog Event Tracking Structures
CeLogData