Hi,

From my driver I want to allocate some virtual memory within a process if a
particular DLL is loaded. The way I hoped to do this is to register a
callback with PsSetLoadImageNotifyRoutine() and then in the callback routine
do the following:
1. Use ZwOpenProcess to get a process handle, I pass in the pid in the
Client Id structure.
2. Call ZwAllocateVirtualMemory passing the process handle received from
ZwOpenProcess.

The problem is that ZwAllocateVM hangs and causes the process that was
launched to never start! After some investigation I have found that the
behaviour of ZwAllocateVM changes depending on which point I call it within
the image load order of the process.
For example, if I launch notepad, the load order is;
1. notepad.exe
2. ntdll.dll
3. kernel32.dll
4. comdlg32.dll
5. shlwapi.dll
6. msvcrt.dll
etc...

If I call ZwAllocateVM in 1 or 2 it works, but from 3 it always appears to
hang! The problem is that the dll I want to wait for is always after kernel32
and so I can't do what I want to do :-(
BTW ZwOpenProcess always seems to work!

Any ideas?
John.