Image_Load class

This class is the event type class for image events.

The following syntax is simplified from MOF code.

Syntax

[EventType(10, 2, 3, 4), EventTypeName("Load", "Unload", "DCStart", "DCEnd")]
class Image_Load : Image
{
  uint32 ImageBase;
  uint32 ImageSize;
  uint32 ProcessId;
  uint32 ImageCheckSum;
  uint32 TimeDateStamp;
  uint32 Reserved0;
  uint32 DefaultBase;
  uint32 Reserved1;
  uint32 Reserved2;
  uint32 Reserved3;
  uint32 Reserved4;
  string FileName;
};

Members

The Image_Load class has these types of members:

• Properties

Properties

The Image_Load class has these properties.

DefaultBase

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(7), Pointer

Default base address.

FileName

Data type: string

Access type: Read-only

Qualifiers: WmiDataId(12), StringTermination("NullTerminated"), Format("w")

File name and extension of the DLL or executable image.

ImageBase

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(1), Pointer

Base address of the application in which the image is loaded.

ImageCheckSum

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(4)

Image check sum.

ImageSize

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2), Pointer

Size of the image being loaded.

When consuming this property, the data type for this property is actually size_t. The Pointer qualifier is used to determine if the size_t is 4-bytes or 8-bytes.

ProcessId

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(3)

Identifies the process into which the image is loaded.

Reserved0

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(6)

Reserved.

Reserved1

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(8)

Reserved.

Reserved2

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(9)

Reserved.

Reserved3

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(10)

Reserved.

Reserved4

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(11)

Reserved.

TimeDateStamp

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(5)

Time and date that the image was loaded or unloaded.

Remarks

The DCStart and DCEnd events enumerate all loaded images at the beginning and end of the trace, respectively.

Requirements

See also

Image

Image_V0

Image_V1