1 out of 2 rated this helpful - Rate this topic

BDCB_IMAGE_INFORMATION structure

The BDCB_IMAGE_INFORMATION structure describes information about a boot-start driver that is about to be initialized, provided by Windows to a boot-start driver's BOOT_DRIVER_CALLBACK_FUNCTION routine.

Syntax

C++


typedef struct _BDCB_IMAGE_INFORMATION {
  BDCB_CLASSIFICATION Classification;
  ULONG               ImageFlags;
  UNICODE_STRING      ImageName;
  UNICODE_STRING      RegistryPath;
  UNICODE_STRING      CertificatePublisher;
  UNICODE_STRING      CertificateIssuer;
  PVOID               ImageHash;
  PVOID               CertificateThumbprint;
  ULONG               ImageHashAlgorithm;
  ULONG               ThumbprintHashAlgorithm;
  ULONG               ImageHashLength;
  ULONG               CertificateThumbprintLength;
} BDCB_IMAGE_INFORMATION, *PBDCB_IMAGE_INFORMATION;

Members

Classification

The classification of the bootstart image.

ImageFlags

Bit flags that describe the image. The following values are defined.

Value	Meaning
Bit 0	The bootstart image is a dependent DLL.
Bit 1	The bootstart image failed code integrity but load was allowed because of boot policy (code integrity not required on the platform, or code integrity disabled because of boot setting, debugging, or both).
Bits 2-31	Do not use. Reserved.

ImageName

The name of the boot-start driver's binary image.

RegistryPath

The path in the registry where the boot-start driver is registered.

CertificatePublisher

The publisher of the image's certificate. If the image is not signed, the string is empty ("").

CertificateIssuer

The issuer of the image's certificate. If the image is not signed, the string is empty ("").

ImageHash

A pointer to the hash of the image. This member is always valid, containing the hash of the image at load time even if the image is not signed.

CertificateThumbprint

A pointer to the hash of the certificate thumbprint. This member is always valid, containing the hash of the certificate thumbprint at load time even if the image is not signed.

ImageHashAlgorithm

The algorithm of the image hash. The following values are listed for reference.

Value
ALG_CLASS_HASH
ALG_CLASS_ANY
ALG_SID_MD5
ALG_SID_SHA1
ALG_SID_SHA_256
ALG_SID_SHA_384
ALG_SID_SHA_512
CALG_MD5
CALG_SHA1
CALG_SHA_256
CALG_SHA_384
CALG_SHA_512

ThumbprintHashAlgorithm

The algorithm of the certificate thumbprint. This member should be ignored if CertificateThumbprint is NULL.

ImageHashLength

The length of data pointed to by the ImageHash member.

CertificateThumbprintLength

The length of data pointed to by the CertificateThumbprint member.

Requirements

Version	Available starting with Windows 8.
Header	Ntddk.h (include Ntddk.h)

BDCB_IMAGE_INFORMATION structure

Syntax

Members

Requirements

See also