35 DPRINT(
"LdrpRecordUnloadEvent(%wZ, %p - %p)\n", &LdrEntry->BaseDllName, LdrEntry->DllBase,
36 (
ULONG_PTR)LdrEntry->DllBase + LdrEntry->SizeOfImage);
static const char * ImageName
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER MaximumSize
ULONG(NTAPI * RTL_TRACE_HASH_FUNCTION)(ULONG Count, PVOID *Trace)
#define RTL_UNLOAD_EVENT_TRACE_NUMBER
BOOLEAN NTAPI RtlTraceDatabaseDestroy(IN PRTL_TRACE_DATABASE Database)
BOOLEAN NTAPI RtlTraceDatabaseLock(IN PRTL_TRACE_DATABASE Database)
static RTL_UNLOAD_EVENT_TRACE RtlpUnloadEventTrace[RTL_UNLOAD_EVENT_TRACE_NUMBER]
BOOLEAN NTAPI RtlTraceDatabaseValidate(IN PRTL_TRACE_DATABASE Database)
BOOLEAN NTAPI RtlTraceDatabaseFind(IN PRTL_TRACE_DATABASE Database, IN ULONG Count, IN PVOID *Trace, OUT OPTIONAL PRTL_TRACE_BLOCK *TraceBlock)
BOOLEAN NTAPI RtlTraceDatabaseUnlock(IN PRTL_TRACE_DATABASE Database)
PRTL_TRACE_DATABASE NTAPI RtlTraceDatabaseCreate(IN ULONG Buckets, IN OPTIONAL SIZE_T MaximumSize, IN ULONG Flags, IN ULONG Tag, IN OPTIONAL RTL_TRACE_HASH_FUNCTION HashFunction)
BOOLEAN NTAPI RtlTraceDatabaseEnumerate(IN PRTL_TRACE_DATABASE Database, IN PRTL_TRACE_ENUMERATE TraceEnumerate, IN OUT PRTL_TRACE_BLOCK *TraceBlock)
static UINT RtlpUnloadEventTraceIndex
PRTL_UNLOAD_EVENT_TRACE NTAPI RtlGetUnloadEventTrace(VOID)
VOID NTAPI LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
BOOLEAN NTAPI RtlTraceDatabaseAdd(IN PRTL_TRACE_DATABASE Database, IN ULONG Count, IN PVOID *Trace, OUT OPTIONAL PRTL_TRACE_BLOCK *TraceBlock)
PULONG MinorVersion OPTIONAL
#define RtlCopyMemory(Destination, Source, Length)
_In_ WDFCOLLECTION _In_ ULONG Index
_Must_inspect_result_ _In_ WDFDEVICE _In_ BOOLEAN _In_opt_ PVOID Tag
_Must_inspect_result_ _In_ ULONG Flags