Image_Load class

This class is the event type class for image events.

The following syntax is simplified from MOF code.

Syntax

[EventType(10, 2, 3, 4), EventTypeName("Load", "Unload", "DCStart", "DCEnd")]class Image_Load : Image
{
  uint32 ImageBase;
  uint32 ImageSize;
  uint32 ProcessId;
  uint32 ImageCheckSum;
  uint32 TimeDateStamp;
  uint32 Reserved0;
  uint32 DefaultBase;
  uint32 Reserved1;
  uint32 Reserved2;
  uint32 Reserved3;
  uint32 Reserved4;
  string FileName;
};

Members

The Image_Load class has these types of members:

Properties

The Image_Load class has these properties.

DefaultBase
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(7), Pointer

Default base address.

FileName
Data type: string
Access type: Read-only
Qualifiers: WmiDataId(12), StringTermination("NullTerminated"), Format("w")

File name and extension of the DLL or executable image.

ImageBase
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(1), Pointer

Base address of the application in which the image is loaded.

ImageCheckSum
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(4)

Image check sum.

ImageSize
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(2), Pointer

Size of the image being loaded.

When consuming this property, the data type for this property is actually size_t. The Pointer qualifier is used to determine if the size_t is 4-bytes or 8-bytes.

ProcessId
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(3)

Identifies the process into which the image is loaded.

Reserved0
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(6)

Reserved.

Reserved1
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(8)

Reserved.

Reserved2
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(9)

Reserved.

Reserved3
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(10)

Reserved.

Reserved4
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(11)

Reserved.

TimeDateStamp
Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId(5)

Time and date that the image was loaded or unloaded.

Remarks

The DCStart and DCEnd events enumerate all loaded images at the beginning and end of the trace, respectively.

Requirements

Minimum supported client

Windows Vista [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]

See also

Image
Image_V0
Image_V1

 

 

Community Additions

ADD
Show:
© 2014 Microsoft