VXDLDR_Notify

include vmm.inc
include vxdldr.inc

; Install a hook procedure
mov esi, OFFSET32 HookProc
VMMcall Hook_Device_Service

jc error
 

This service is called internally by VXDLDR at various stages of its operation. Devices which need to be notified of VXDLDR activity should hook this service.

The system calls the hook procedure as follows:

mov eax, NotificationCode
; other registers depending on the NotificationCode
call HookProc
 

NotificationCode

The notification code. Note that other registers may be used depending on the notification code. The following VXDLDR notification codes are defined:

Code	Meaning
Ordinal of VXDLDR_Notify	General notification.
VXDLDR_NOTIFY_OBJECTUNLOAD	A dynamic object is being uloaded.

Register	Meaning
EDI	Address of the DeviceInfo structure for device being unloaded
EBX	Address of the ObjectInfo structure for object being unloaded.
EDX	Object number.

Each hook must preserve all registers and propagate the call down the chain. Any registers not explicitly defined are reserved for future extension of this service.

Do not use the DI_DDB member in the DeviceInfo structure because the DDB may have been freed.