IMAGE_INFO structure (ntddk.h)
The IMAGE_INFO structure is used by driver's load-image routine (PLOAD_IMAGE_NOTIFY_ROUTINE) to specify load image information.
Syntax
typedef struct _IMAGE_INFO {
union {
ULONG Properties;
struct {
ULONG ImageAddressingMode : 8;
ULONG SystemModeImage : 1;
ULONG ImageMappedToAllPids : 1;
ULONG ExtendedInfoPresent : 1;
ULONG MachineTypeMismatch : 1;
ULONG ImageSignatureLevel : 4;
ULONG ImageSignatureType : 3;
ULONG ImagePartialMap : 1;
ULONG Reserved : 12;
};
};
PVOID ImageBase;
ULONG ImageSelector;
SIZE_T ImageSize;
ULONG ImageSectionNumber;
} IMAGE_INFO, *PIMAGE_INFO;
Members
Properties
Represents all the bit values within the structure that Properties is unioned with.
ImageAddressingMode
Always set to IMAGE_ADDRESSING_MODE_32BIT.
SystemModeImage
Set either to one for newly loaded kernel-mode components, such as drivers, or to zero for images that are mapped into user space.
ImageMappedToAllPids
Always set to zero.
ExtendedInfoPresent
If the ExtendedInfoPresent flag is set, IMAGE_INFO is a part of IMAGE_INFO_EX. Added in Windows Vista.
MachineTypeMismatch
Always set to zero. Added in Windows 8/Windows Server 2012.
ImageSignatureLevel
The level of signature with which code integrity has labeled the image. This value is one of the #define SE_SIGNING_LEVEL_* constants in ntddk.h. Added in Windows 8.1/Windows Server 2012 R2.
ImageSignatureType
The type of signature with which code integrity has labeled the image. This value is a SE_IMAGE_SIGNATURE_TYPE enumeration value, defined in ntddk.h. Added in Windows 8.1/Windows Server 2012 R2.
ImagePartialMap
This value is non-zero if the image mapping view called out for is a partial view that does not map the entire image; 0 if the view maps the entire image. Added in Windows 10/Windows Server 2016.
Reserved
Always set to zero.
ImageBase
Set to the virtual base address of the image.
ImageSelector
Always set to zero.
ImageSize
Set to the virtual size, in bytes, of the image.
ImageSectionNumber
Always set to zero.
Remarks
If the ExtendedInfoPresent flag is set, the IMAGE_INFO structure is part of IMAGE_INFO_EX, which is a larger, extended version of the image information structure. In this case, the load-image notify routine can use the CONTAINING_RECORD macro (in miniport.h) to obtain the base address of the IMAGE_INFO_EX structure.
Requirements
| Requirement | Value |
|---|---|
| Header | ntddk.h (include Ntddk.h) |