Carlbyte wrote:IRP worked perfectly! The system displays a message invalid file and does not load the file. Worked for EXE, DLL and SYS and did not stop the exe worked in the case of dll. So who are looking for this information, use IRP instead of PsSetLoadImageNotifyRoutine.Happy to hear it worked!
As PsSetLoadImageNotifyRoutine may suggest, it registers a NOTIFY callback, meaning that the callback is called to NOTIFY your driver about an image loaded. Notifying does not necessarily mean there is a documented way of blocking the event at that point.
