Current stand: I can, thanks to your guidance change the access and set a memory breakpoint, using the LOAD_DLL_DEBUG_EVENT exception to get a valid address space. However, I can't seem to get the name of the loaded DLL. Is it possible to cast the unicode value lpImageName in LOAD_DLL_DEBUG_INFO to a string somehow?