PEB_LDR_DATA - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTPSAPI_H

//
// Process information structures
//

/**
 * The PEB_LDR_DATA structure contains information about the loaded modules for the process.
 * \sa https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb_ldr_data
 */
typedef struct _PEB_LDR_DATA
{
    ULONG Length;
    BOOLEAN Initialized;
    HANDLE SsHandle;
    LIST_ENTRY InLoadOrderModuleList;
    LIST_ENTRY InMemoryOrderModuleList;
    LIST_ENTRY InInitializationOrderModuleList;
    PVOID EntryInProgress;
    BOOLEAN ShutdownInProgress;
    HANDLE ShutdownThreadId;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

#endif

View code on GitHub
// winternl.h

typedef struct _PEB_LDR_DATA {
  BYTE       Reserved1[8];
  PVOID      Reserved2[3];
  LIST_ENTRY InMemoryOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
View the official Win32 API reference

NtDoc

No description available.

Edit description on GitHub

Win32 API reference (ns-winternl-peb_ldr_data)

PEB_LDR_DATA structure

Description

[This structure may be altered in future versions of Windows.]

Contains information about the loaded modules for the process.

Members

Reserved1

Reserved for internal use by the operating system.

Reserved2

Reserved for internal use by the operating system.

InMemoryOrderModuleList

The head of a doubly-linked list that contains the loaded modules for the process. Each item in the list is a pointer to an LDR_DATA_TABLE_ENTRY structure. For more information, see Remarks.

Remarks

The LIST_ENTRY structure is defined as follows:

typedef struct _LIST_ENTRY {
   struct _LIST_ENTRY *Flink;
   struct _LIST_ENTRY *Blink;
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;

The LDR_DATA_TABLE_ENTRY structure is defined as follows:

typedef struct _LDR_DATA_TABLE_ENTRY {
    PVOID Reserved1[2];
    LIST_ENTRY InMemoryOrderLinks;
    PVOID Reserved2[2];
    PVOID DllBase;
    PVOID Reserved3[2];
    UNICODE_STRING FullDllName;
    BYTE Reserved4[8];
    PVOID Reserved5[3];
    union
    {
        ULONG CheckSum;
        PVOID Reserved6;
    };
    ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

See also

PEB

View the official Win32 API reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This structure is documented in Windows SDK.

Length

Size of structure, used by ntdll.dll as structure version ID.

Initialized

If set, loader data section for current process is initialized.

SsHandle

???

InLoadOrderModuleList

Doubly linked list containing pointers to LDR_MODULE structure for previous and next module in load order.

InMemoryOrderModuleList

As above, but in memory placement order.

InInitializationOrderModuleList

As InLoadOrderModuleList, but in initialization order.

Documented by

See also

Edit description on GitHub