看了不少关于_LDR_MODULE定义的贴，
[_LDR_MODULE -------->>> LDR_DATA_TABLE_ENTRY]
自己在实际中的发现，却与这个定义有点出入。我的系统信息如下:
OS 名称: Microsoft Windows XP Professional
OS 版本: 5.1.2600 Service Pack 2 Build 2600
======================================
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
WORD LoadCount;
WORD TlsIndex;
union
{
LIST_ENTRY HashLinks;
struct
{
PVOID SectionPointer;
ULONG CheckSum;
};
};
union
{
ULONG TimeDateStamp;
PVOID LoadedImports;
};
_ACTIVATION_CONTEXT * EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY ForwarderLinks;
LIST_ENTRY ServiceTagLinks;
LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
来源网址[在此只列出2个]:
http://www.nirsoft.net/kernel_struct/vista/LDR_DATA_TABLE_ENTRY.html
http://hi.baidu.com/kgdiwss/blog/item/bd450255aceef1c2b645ae16.html
=================================================
问题出现了，下面是我自己实际当中遇见的情况，
00251EE0 00251F48 // struct _LIST_ENTRY *Flink;
00251EE4 00251EAC // struct _LIST_ENTRY *Blink;
00251EE8 00251F50 // struct _LIST_ENTRY *Flink;
00251EEC 00251EB4 // struct _LIST_ENTRY *Blink;
00251EF0 00000000
00251EF4 00000000
00251EF8 00400000 Kernel32.00400000 // BaseAddress
00251EFC 004010A0 Kernel32.<模块入口点> // EntryPoint
00251F00 0002C000 // SizeOfImage
00251F04 00CA00C8 // ?????
00251F08 00020914 UNICODE "C:\Documents and Settings\Administrator\" // FullDllName
00251F0C 00380036 // ????
00251F10 000209A6 UNICODE "Kernel32_GetProcAddress.exe" // BaseDllName
00251F14 00005000 // Flags
00251F18 0000FFFF // 下面的结构对不上------- !!!!!!
00251F1C 0025204C
00251F20 7C99E2B0 ntdll.7C99E2B0
00251F24 4E21DB0B
00251F28 00000000
00251F2C 00000000
00251F30 ABABABAB
00251F34 ABABABAB
00251F38 00000000
00251F3C 00000000
00251F40 000D000D
00251F44 0018076E
00251F48 00252010
00251F4C 00251EE0
00251F50 00252018
00251F54 00251EE8
00251F58 00252020
00251F5C 00251EBC
00251F60 7C920000 ntdll.7C920000
00251F64 7C932C46 ntdll.<模块入口点>
00251F68 00096000
00251F6C 0208003A
00251F70 7C9A0028 UNICODE "C:\WINDOWS\system32\ntdll.dll"
00251F74 00140012
00251F78 7C941ED0 UNICODE "ntdll.dll"
00251F7C 00084004
00251F80 0000FFFF
00251F84 7C99E2C8 ntdll.7C99E2C8
00251F88 7C99E2C8 ntdll.7C99E2C8
00251F8C 49900311
00251F90 00000000
00251F94 00000000
00251F98 ABABABAB
00251F9C ABABABAB
00251FA0 00000000
00251FA4 00000000
00251FA8 000D000C
00251FAC 001E0773
00251FB0 003A0043
00251FB4 0057005C
00251FB8 004E0049
00251FBC 004F0044
00251FC0 00530057
00251FC4 0073005C
00251FC8 00730079
00251FCC 00650074
00251FD0 0033006D
00251FD4 005C0032
00251FD8 0065006B
00251FDC 006E0072
00251FE0 006C0065
00251FE4 00320033
00251FE8 0064002E
00251FEC 006C006C
00251FF0 ABAB0000
00251FF4 ABABABAB
00251FF8 FEEEABAB
00251FFC FEEEFEEE
00252000 00000000
00252004 00000000
00252008 000C000D
0025200C 00180787
00252010 00251EAC
00252014 00251F48
00252018 00251EB4
0025201C 00251F50
00252020 00251EBC
00252024 00251F58
00252028 7C800000 kernel_1.7C800000
0025202C 7C80B5BE kernel_1.<模块入口点>
00252030 0011D000
00252034 00420040 Kernel32.00420040
00252038 00251FB0 UNICODE "C:\WINDOWS\system32\kernel32.dll"
0025203C 001A0018
00252040 00251FD8 UNICODE "kernel32.dll"
00252044 00084004
00252048 0000FFFF
0025204C 7C99E2B0 ntdll.7C99E2B0
00252050 00251F1C
00252054 49C4F753
00252058 00000000
0025205C 00000000
00252060 ABABABAB
00252064 ABABABAB
00252068 00000000
0025206C 00000000
00252070 000D07F2
00252074 00EE14EE
00252078 00250178
0025207C 00250178
00252080 FEEEFEEE
00252084 FEEEFEEE
00252088 FEEEFEEE
0025208C FEEEFEEE
============================================
希望大家能解释一下，上面的两处 “?????” 到底是何作用，并附上一份LDR_DATA_TABLE_ENTRY的正式定义，因为发现好多LDR_DATA_TABLE_ENTRY与自己的发现有些出入，所以不由的怀疑网上的那些定义。
如果有什么不对的地方，欢迎大家指正.
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
