LdrDllNotification callback function

Article
01/06/2021

[This function may be changed or removed from Windows without further notice.]

A notification callback function specified with the LdrRegisterDllNotification function. The loader calls this function when a DLL is first loaded.

Warning: It is unsafe for the notification callback function to call functions in any DLL.

Syntax

VOID CALLBACK LdrDllNotification(
  _In_     ULONG                       NotificationReason,
  _In_     PCLDR_DLL_NOTIFICATION_DATA NotificationData,
  _In_opt_ PVOID                       Context
);

Parameters

NotificationReason [in]

The reason that the notification callback function was called. This parameter can be one of the following values.

Value	Meaning
LDR_DLL_NOTIFICATION_REASON_LOADED 1	The DLL was loaded. The NotificationData parameter points to an LDR_DLL_LOADED_NOTIFICATION_DATA structure.
LDR_DLL_NOTIFICATION_REASON_UNLOADED 2	The DLL was unloaded. The NotificationData parameter points to an LDR_DLL_UNLOADED_NOTIFICATION_DATA structure.

NotificationData [in]

A pointer to a constant LDR_DLL_NOTIFICATION union that contains notification data. This union has the following definition:

typedef union _LDR_DLL_NOTIFICATION_DATA {
    LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
    LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
} LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;

The LDR_DLL_LOADED_NOTIFICATION_DATA structure has the following definition:

typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA {
    ULONG Flags;                    //Reserved.
    PCUNICODE_STRING FullDllName;   //The full path name of the DLL module.
    PCUNICODE_STRING BaseDllName;   //The base file name of the DLL module.
    PVOID DllBase;                  //A pointer to the base address for the DLL in memory.
    ULONG SizeOfImage;              //The size of the DLL image, in bytes.
} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;

The LDR_DLL_UNLOADED_NOTIFICATION_DATA structure has the following definition:

typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA {
    ULONG Flags;                    //Reserved.
    PCUNICODE_STRING FullDllName;   //The full path name of the DLL module.
    PCUNICODE_STRING BaseDllName;   //The base file name of the DLL module.
    PVOID DllBase;                  //A pointer to the base address for the DLL in memory.
    ULONG SizeOfImage;              //The size of the DLL image, in bytes.
} LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;

Context [in, optional]

A pointer to context data for the callback function.

Return value

This callback function does not return a value.

Remarks

The notification callback function is called before dynamic linking takes place.

Requirements

Requirement	Value
Minimum supported client	Windows Vista [desktop apps only]
Minimum supported server	Windows Server 2008 [desktop apps only]