Geoff Chappell - Software Analyst
As captured amply well by its name, the LDR_DLL_LOAD_REASON enumeration (formally _LDR_DLL_LOAD_REASON) tells something of why or how a DLL got loaded. It is thought to exist only as the LoadReason member of the LDR_DATA_TABLE_ENTRY.
The defined values and Microsoft’s names for them are known from public symbol files for the kernel, starting with Windows 8.
|0||LoadReasonStaticDependency||6.2 and higher|
|1||LoadReasonStaticForwarderDependency||6.2 and higher|
|2||LoadReasonDynamicForwarderDependency||6.2 and higher|
|3||LoadReasonDelayloadDependency||6.2 and higher|
|4||LoadReasonDynamicLoad||6.2 and higher|
|5||LoadReasonAsImageLoad||6.2 and higher|
|6||LoadReasonAsDataLoad||6.2 and higher|
|7||LoadReasonEnclavePrimary||1709 and higher|
|8||LoadReasonEnclaveDependency||1709 and higher|
|-1||LoadReasonUnknown||6.2 and higher|