┌──────────────────────────────┬──────────┬──────────────────────────────┐
│Event                         │Code      │Description                   │
├──────────────────────────────┼──────────┼──────────────────────────────┤
│KDP_T_LINK                    │102       │Module loaded                 │
├──────────────────────────────┼──────────┼──────────────────────────────┤
│KDP_T_UNLINK                  │103       │Module unloaded               │
└──────────────────────────────┴──────────┴──────────────────────────────┘

Fields returned in cvkcmd_s are as follows:

Cmd

CVK_RET_LIB or CVK_RET_KIL
Value
MTE handle of module in question.
OffV
Not used.
SegV
Slot number of thread.
MTE
MTE entry of executable running in process.
PID
PID of process that generated the event.
TID
TID of thread that generated the event.
DBit
Not used.
UCHAR NAME[ ]
Null-terminated full pathname of module in question (immediately follows DBit and overlays Reg and MemCache)

---

[Back] [Next]