Image_Load class
This class is the event type class for image events.
The following syntax is simplified from MOF code.
Syntax
[EventType(10, 2, 3, 4), EventTypeName("Load", "Unload", "DCStart", "DCEnd")]
class Image_Load : Image
{
uint32 ImageBase;
uint32 ImageSize;
uint32 ProcessId;
uint32 ImageCheckSum;
uint32 TimeDateStamp;
uint32 Reserved0;
uint32 DefaultBase;
uint32 Reserved1;
uint32 Reserved2;
uint32 Reserved3;
uint32 Reserved4;
string FileName;
};
Members
The Image_Load class has these types of members:
Properties
The Image_Load class has these properties.
-
DefaultBase
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(7), Pointer
Default base address.
-
-
FileName
-
-
Data type: string
-
Access type: Read-only
-
Qualifiers: WmiDataId(12), StringTermination("NullTerminated"), Format("w")
File name and extension of the DLL or executable image.
-
-
ImageBase
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(1), Pointer
Base address of the application in which the image is loaded.
-
-
ImageCheckSum
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(4)
Image check sum.
-
-
ImageSize
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(2), Pointer
Size of the image being loaded.
When consuming this property, the data type for this property is actually size_t. The Pointer qualifier is used to determine if the size_t is 4-bytes or 8-bytes.
-
-
ProcessId
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(3)
Identifies the process into which the image is loaded.
-
-
Reserved0
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(6)
Reserved.
-
-
Reserved1
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(8)
Reserved.
-
-
Reserved2
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(9)
Reserved.
-
-
Reserved3
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(10)
Reserved.
-
-
Reserved4
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(11)
Reserved.
-
-
TimeDateStamp
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(5)
Time and date that the image was loaded or unloaded.
-
Remarks
The DCStart and DCEnd events enumerate all loaded images at the beginning and end of the trace, respectively.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows Vista [desktop apps only] |
| Minimum supported server |
Windows Server 2008 [desktop apps only] |
See also