IMAGE_INFO - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// ntddk.h
typedef struct _IMAGE_INFO {
union {
ULONG Properties;
struct {
ULONG ImageAddressingMode : 8;
ULONG SystemModeImage : 1;
ULONG ImageMappedToAllPids : 1;
ULONG ExtendedInfoPresent : 1;
ULONG MachineTypeMismatch : 1;
ULONG ImageSignatureLevel : 4;
ULONG ImageSignatureType : 3;
ULONG ImagePartialMap : 1;
ULONG Reserved : 12;
};
};
PVOID ImageBase;
ULONG ImageSelector;
SIZE_T ImageSize;
ULONG ImageSectionNumber;
} IMAGE_INFO, *PIMAGE_INFO;
View the official Windows Driver Kit DDI referenceNo description available.
The IMAGE_INFO structure is used by driver's load-image routine (PLOAD_IMAGE_NOTIFY_ROUTINE) to specify load image information.
PropertiesRepresents all the bit values within the structure that Properties is unioned with.
ImageAddressingModeAlways set to IMAGE_ADDRESSING_MODE_32BIT.
SystemModeImageSet either to one for newly loaded kernel-mode components, such as drivers, or to zero for images that are mapped into user space.
ImageMappedToAllPidsAlways set to zero.
ExtendedInfoPresentIf the ExtendedInfoPresent flag is set, IMAGE_INFO is a part of IMAGE_INFO_EX. Added in Windows Vista.
MachineTypeMismatchAlways set to zero. Added in Windows 8/Windows Server 2012.
ImageSignatureLevelThe level of signature with which code integrity has labeled the image. This value is one of the #define SE_SIGNING_LEVEL_* constants in ntddk.h. Added in Windows 8.1/Windows Server 2012 R2.
ImageSignatureTypeThe type of signature with which code integrity has labeled the image. This value is a SE_IMAGE_SIGNATURE_TYPE enumeration value, defined in ntddk.h. Added in Windows 8.1/Windows Server 2012 R2.
ImagePartialMapThis value is non-zero if the image mapping view called out for is a partial view that does not map the entire image; 0 if the view maps the entire image. Added in Windows 10/Windows Server 2016.
ReservedAlways set to zero.
ImageBaseSet to the virtual base address of the image.
ImageSelectorAlways set to zero.
ImageSizeSet to the virtual size, in bytes, of the image.
ImageSectionNumberAlways set to zero.
If the ExtendedInfoPresent flag is set, the IMAGE_INFO structure is part of IMAGE_INFO_EX, which is a larger, extended version of the image information structure. In this case, the load-image notify routine can use the CONTAINING_RECORD macro (in miniport.h) to obtain the base address of the IMAGE_INFO_EX structure.