Undocumented functions of NTDLL

2OOO, 27 December

typedef struct _LDR_MODULE {



  LIST_ENTRY              InLoadOrderModuleList;
  LIST_ENTRY              InMemoryOrderModuleList;
  LIST_ENTRY              InInitializationOrderModuleList;
  PVOID                   BaseAddress;
  PVOID                   EntryPoint;
  ULONG                   SizeOfImage;
  UNICODE_STRING          FullDllName;
  UNICODE_STRING          BaseDllName;
  ULONG                   Flags;
  SHORT                   LoadCount;
  SHORT                   TlsIndex;
  LIST_ENTRY              HashTableEntry;
  ULONG                   TimeDateStamp;

} LDR_MODULE, *PLDR_MODULE;

InLoadOrderModuleList

Pointers to previous and next LDR_MODULE in load order.

InMemoryOrderModuleList

Pointers to previous and next LDR_MODULE in memory placement order.

InInitializationOrderModuleList

Pointers to previous and next LDR_MODULE in initialization order.

BaseAddress

Module base address known also as HMODULE.

EntryPoint

Module entry point (address of initialization procedure).

SizeOfImage

Sum of all image's sections placed in memory. Rounded up to 4Kb (page size).

FullDllName

Path and name of module.

BaseDllName

Module name only.

Flags

LoadCount

TlsIndex

HashTableEntry

LIST_ENTRY contains pointer to LdrpHashTable. Both prev and next values are the same.
LdrpHashTable it is table of LIST_ENTRY structures points to LDR_MODULE for current process.

TimeDateStamp

Documented by:

Reactos

Tomasz Nowak

Library: ntdll.lib

PEB_LDR_DATA