Type__ERequestType

_ERequestType enumeration

Summary

Type of request reported by the IRPMon driver.

Values

ertImageLoad

A PE image (EXE, DLL or driver) was mapped into memory.

ertProcessExitted

An existing process has terminated.

ertProcessCreated

New process has been created.

ertFileObjectNameDeleted

A file object was stripped from its file name.

The IRPMon driver send this event when an IRP_MJ_CLEANUP IRP IS received and completed for the file object.

ertFileObjectNameAssigned

A file object just got its file name

ertDeviceDetected

A previously unknown device was detected.

ertDriverDetected

A previously unknown driver was detected.

ertStartIo

Driver's StartIo routine was invoked.

ertFastIo

A fast I/O request was serviced by a driver.

ertDriverUnload

A driver was unloaded.

ertAddDevice

Driver's AddDevice routine was called in order to inform the driver about a newly detected device.

ertIRPCompletion

An IRP is completed.

ertIRP

I/O request packet (IRP).

erpUndefined

Exists only for debugging purposes, should not be ever used.

Requirements

Header	general-types.h