PageFault_ImageLoadBacked class

This class is the event type class for image load in page file events.

The following syntax is simplified from MOF code.

Syntax

[EventType{105}, EventTypeName{"ImageLoadBacked"}]
class PageFault_ImageLoadBacked : PageFault_V2
{
  uint32 FileObject;
  uint32 DeviceChar;
  uint16 FileChar;
  uint16 LoadFlags;
};

Members

The PageFault_ImageLoadBacked class has these types of members:

• Properties

Properties

The PageFault_ImageLoadBacked class has these properties.

DeviceChar

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2), Format("x")

Reserved.

FileChar

Data type: uint16

Access type: Read-only

Qualifiers: WmiDataId(3), Format("x")

Reserved.

FileObject

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(1), Pointer

Match the value of this pointer to the FileObject pointer value in a FileIo_Name event to determine the name of the file.

LoadFlags

Data type: uint16

Access type: Read-only

Qualifiers: WmiDataId(4), Format("x")

Reserved.

Remarks

The event is logged during an image section creation (for example, a DLL load) when the memory manager determines that the image needs to be copied into and run from the page file. Typically, images are run from the source file but pagefile-backing can occur when the memory manager determines that the source file may be modified asynchronously by existing writers or when the source file is on a removable media or a remote device.

Requirements

See also

PageFault_V2