[Drive development] struct _ldr_data_table_entry

@Windows XP Professional Service Pack 3 (x86) (5.1, Build 2600)

1 lkd> dt-b _ldr_data_table_entry2 Nt!_ldr_data_table_entry3 +0x000 inloadorderlinks: _list_entry4 +0x000 Flink:ptr325 +0x004 Blink:ptr326 +0x008 inmemoryorderlinks: _list_entry7 +0x000 Flink:ptr328 +0x004 Blink:ptr329 +0x010 ininitializationorderlinks: _list_entryTen +0x000 Flink:ptr32 One +0x004 Blink:ptr32 A +0x018 Dllbase:ptr32 - +0x01c Entrypoint:ptr32 - +0x020 sizeofimage:uint4b the +0x024 fulldllname: _unicode_string - +0x000 length:uint2b - +0x002 maximumlength:uint2b - +0x004 Buffer:ptr32 + +0x02c basedllname: _unicode_string - +0x000 length:uint2b + +0x002 maximumlength:uint2b A +0x004 Buffer:ptr32 at +0x034 flags:uint4b - +0x038 loadcount:uint2b - +0x03a tlsindex:uint2b - +0x03c hashlinks: _list_entry - +0x000 Flink:ptr32 - +0x004 Blink:ptr32 in +0x03c Sectionpointer:ptr32 - +0x040 checksum:uint4b to +0x044 timedatestamp:uint4b + +0x044 Loadedimports:ptr32 - +0x048 Entrypointactivationcontext:ptr32 the+0X04C Patchinformation:ptr32

@Windows 7 Ultimate (x64) (6.1, Build 7600)

1 lkd> dt-b _ldr_data_table_entry2 Nt!_ldr_data_table_entry3 +0x000 inloadorderlinks: _list_entry4 +0x000 flink:ptr645 +0x008 blink:ptr646 +0x010 inmemoryorderlinks: _list_entry7 +0x000 flink:ptr648 +0x008 blink:ptr649 +0x020 ininitializationorderlinks: _list_entryTen +0x000 flink:ptr64 One +0x008 blink:ptr64 A +0x030 dllbase:ptr64 - +0x038 entrypoint:ptr64 - +0x040 sizeofimage:uint4b the +0x048 fulldllname: _unicode_string - +0x000 length:uint2b - +0x002 maximumlength:uint2b - +0x008 buffer:ptr64 + +0x058 basedllname: _unicode_string - +0x000 length:uint2b + +0x002 maximumlength:uint2b A +0x008 buffer:ptr64 at +0x068 flags:uint4b - +0x06c loadcount:uint2b - +0x06e tlsindex:uint2b - +0x070 hashlinks: _list_entry - +0x000 flink:ptr64 - +0x008 blink:ptr64 in +0x070 sectionpointer:ptr64 - +0x078 checksum:uint4b to +0x080 timedatestamp:uint4b + +0x080 loadedimports:ptr64 - +0x088 entrypointactivationcontext:ptr64 the +0x090 patchinformation:ptr64 * +0x098 forwarderlinks: _list_entry $ +0x000 flink:ptr64Panax Notoginseng +0x008 blink:ptr64 - +0x0a8 servicetaglinks: _list_entry the +0x000 flink:ptr64 + +0x008 blink:ptr64 A +0x0b8 staticlinks: _list_entry the +0x000 flink:ptr64 + +0x008 blink:ptr64 - +0x0c8 contextinformation:ptr64 $ +0x0d0 originalbase:uint8b $ +0x0d8 loadtime: _large_integer - +0x000 lowpart:uint4b - +0x004 highpart:int4b the +0x000 u: <unnamed-tag> - +0x000 lowpart:uint4bWuyi +0x004 highpart:int4b
 the+0x000 quadpart:int8b

C + + Code

typedefstruct_ldr_data_table_entry {//Start from Windows XPList_entry inloadorderlinks;    List_entry inmemoryorderlinks;    List_entry ininitializationorderlinks;    PVOID dllbase;    PVOID entrypoint;    ULONG Sizeofimage;    Unicode_string Fulldllname;    Unicode_string Basedllname;    ULONG Flags;    USHORT Loadcount;        USHORT TlsIndex;        Union {list_entry Hashlinks; struct{PVOID sectionpointer;        ULONG CheckSum;    };    };        Union {ULONG TimeDateStamp;    PVOID Loadedimports;    };        PVOID Entrypointactivationcontext; //_activation_context *PVOID patchinformation; //Start from Windows VistaList_entry forwarderlinks;    List_entry servicetaglinks;    List_entry staticlinks;    PVOID contextinformation;    PVOID originalbase; Large_integer Loadtime;} Ldr_data_table_entry,*pldr_data_table_entry;

[Drive development] struct _ldr_data_table_entry