Update _PEB_LDR_DATA definition with fields known since WinXP

This commit is contained in:
hakril
2025-01-24 08:59:37 +01:00
parent 217da0d6b1
commit db8d782e3a
3 changed files with 43 additions and 12 deletions
@@ -4,11 +4,18 @@ typedef struct _LIST_ENTRY {
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
/* Definition of WinXP : Still same base in win11 with some extra field */
typedef struct _PEB_LDR_DATA {
BYTE Reserved1[8];
PVOID Reserved2[3];
LIST_ENTRY InMemoryOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
ULONG Length;
BYTE Initialized;
PVOID SsHandle;
_LIST_ENTRY InLoadOrderModuleList;
_LIST_ENTRY InMemoryOrderModuleList;
_LIST_ENTRY InInitializationOrderModuleList;
PVOID EntryInProgress;
// BYTE ShutdownInProgress; // New field
// PVOID ShutdownThreadId; // New field
}PEB_LDR_DATA, *PPEB_LDR_DATA;
typedef struct _LSA_UNICODE_STRING {
+25 -5
View File
@@ -10521,19 +10521,39 @@ _PEB_LDR_DATA
.. class:: _PEB_LDR_DATA
.. attribute:: Reserved1
.. attribute:: Length
:class:`BYTE` ``[8]``
:class:`ULONG`
.. attribute:: Reserved2
.. attribute:: Initialized
:class:`PVOID` ``[3]``
:class:`BYTE`
.. attribute:: SsHandle
:class:`PVOID`
.. attribute:: InLoadOrderModuleList
:class:`_LIST_ENTRY`
.. attribute:: InMemoryOrderModuleList
:class:`LIST_ENTRY`
:class:`_LIST_ENTRY`
.. attribute:: InInitializationOrderModuleList
:class:`_LIST_ENTRY`
.. attribute:: EntryInProgress
:class:`PVOID`
_LSA_UNICODE_STRING
'''''''''''''''''''
+7 -3
View File
@@ -5438,9 +5438,13 @@ _LIST_ENTRY._fields_ = [
class _PEB_LDR_DATA(Structure):
_fields_ = [
("Reserved1", BYTE * (8)),
("Reserved2", PVOID * (3)),
("InMemoryOrderModuleList", LIST_ENTRY),
("Length", ULONG),
("Initialized", BYTE),
("SsHandle", PVOID),
("InLoadOrderModuleList", _LIST_ENTRY),
("InMemoryOrderModuleList", _LIST_ENTRY),
("InInitializationOrderModuleList", _LIST_ENTRY),
("EntryInProgress", PVOID),
]
PEB_LDR_DATA = _PEB_LDR_DATA
PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA)