结构体:PEB_LDR_DATA
typedef struct _PEB_LDR_DATA {
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
参数介绍:
Length
Size of structure, used by ntdll.dll as structure version ID.
Initialized
If set, loader data section for current process is initialized.
SsHandle
- ???
InLoadOrderModuleList
Doubly linked list containing pointers to LDR_MODULE structure for previous and next module in load order.
InMemoryOrderModuleList
As above, but in memory placement order.
InInitializationOrderModuleList
As InLoadOrderModuleList, but in initialization order.
结构体:LDR_MODULE
typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;
参数介绍:
InLoadOrderModuleList
Pointers to previous and next LDR_MODULE in load order.
InMemoryOrderModuleList
Pointers to previous and next LDR_MODULE in memory placement order.
InInitializationOrderModuleList
Pointers to previous and next LDR_MODULE in initialization order.
BaseAddress
Module base address known also as HMODULE.
EntryPoint
Module entry point (address of initialization procedure).
SizeOfImage
Sum of all image's sections placed in memory. Rounded up to 4Kb (page size).
FullDllName
Path and name of module.
BaseDllName
Module name only.
Flags
LoadCount
TlsIndex
HashTableEntry
LIST_ENTRY contains pointer to LdrpHashTable. Both prev and next values are the same.
LdrpHashTable it is table of LIST_ENTRY structures points to LDR_MODULE for current process.
