[myid]

I use PsGetCurrentProcessId in LoadImageNotify, but i get 4 forever.

Can I get real pid in LoadImageNotify?

Do not use hook, because we cannot hook legally in Windows x64.

[EP_X0FF]

For drivers there always will be "System" because they are loaded in context of system process. The ProcessId handle of callback routine identifies the process in which the image has been mapped, but this handle is zero if the newly loaded image is a driver.

[myid]

For drivers there always will be "System" because they are loaded in context of system process. The ProcessId handle of callback routine identifies the process in which the image has been mapped, but this handle is zero if the newly loaded image is a driver.

So, no one can get real PID in LoadImageNotify, right?

[EP_X0FF]

For drivers there always will be "System" because they are loaded in context of system process. The ProcessId handle of callback routine identifies the process in which the image has been mapped, but this handle is zero if the newly loaded image is a driver.

So, no one can get real PID in LoadImageNotify, right?

Yes, you need workaround. As example take Kaspersky AV. By killing it "proactive" part step by step (remove service hooks, remove notifies) you can see how they implemented info gathering for their "Driver loading" popup. Or look inside it source codes (warning: they are awful).