include vmm.inc include vxdldr.inc ; Install a hook procedure mov esi, OFFSET32 HookProc VMMcall Hook_Device_Service jc error
This service is called internally by VXDLDR at various stages of its operation. Devices which need to be notified of VXDLDR activity should hook this service.
The system calls the hook procedure as follows:
mov eax, NotificationCode ; other registers depending on the NotificationCode call HookProc
NotificationCode
The notification code. Note that other registers may be used depending on the notification code. The following VXDLDR notification codes are defined:
Code | Meaning |
Ordinal of VXDLDR_Notify | General notification. |
VXDLDR_NOTIFY_OBJECTUNLOAD | A dynamic object is being uloaded. |
Register | Meaning |
EDI | Address of the DeviceInfo structure for device being unloaded |
EBX | Address of the ObjectInfo structure for object being unloaded. |
EDX | Object number. |
Each hook must preserve all registers and propagate the call down the chain. Any registers not explicitly defined are reserved for future extension of this service.
Do not use the DI_DDB member in the DeviceInfo structure because the DDB may have been freed.