Geoff Chappell - Software Analyst
As captured amply well by its name, the LDR_DLL_LOAD_REASON enumeration (formally _LDR_DLL_LOAD_REASON) tells something of why or how a DLL got loaded. It is thought to exist only as the LoadReason member of the LDR_DATA_TABLE_ENTRY.
The defined values and Microsoft’s names for them are known from public symbol files for the kernel, starting with Windows 8.
| Value | Name | Versions |
|---|---|---|
| 0 | LoadReasonStaticDependency | 6.2 and higher |
| 1 | LoadReasonStaticForwarderDependency | 6.2 and higher |
| 2 | LoadReasonDynamicForwarderDependency | 6.2 and higher |
| 3 | LoadReasonDelayloadDependency | 6.2 and higher |
| 4 | LoadReasonDynamicLoad | 6.2 and higher |
| 5 | LoadReasonAsImageLoad | 6.2 and higher |
| 6 | LoadReasonAsDataLoad | 6.2 and higher |
| 7 | LoadReasonEnclavePrimary | 1709 and higher |
| 8 | LoadReasonEnclaveDependency | 1709 and higher |
| -1 | LoadReasonUnknown | 6.2 and higher |