Skip to content

Instantly share code, notes, and snippets.

@alfarom256
Created August 25, 2020 15:35
Show Gist options
  • Save alfarom256/f26dba14e202cb8728169fe70aa26094 to your computer and use it in GitHub Desktop.
Save alfarom256/f26dba14e202cb8728169fe70aa26094 to your computer and use it in GitHub Desktop.
#[repr(C)]
pub struct LDR_DATA_TABLE_ENTRY<'ldte> {
pub _reserved0: [PVOID; 2],
pub in_initialize_order_links: LIST_ENTRY<'ldte>,
// removed PVOID[2]
pub dll_base: PVOID,
pub entry_point: PVOID,
pub _reserved1: [PVOID; 3], // Additional 2 PVOID's go here
pub full_dll_name: UNICODE_STRING,
pub _reserved3: [u8; 8],
pub _reserved4: [PVOID; 3],
pub ldte_union: LDTE_UNION,
pub time_date_stamp: u32,
}
/*
typedef struct _LDR_DATA_TABLE_ENTRY {
PVOID Reserved1[2];
LIST_ENTRY InMemoryOrderLinks;
PVOID Reserved2[2];
PVOID DllBase;
PVOID EntryPoint;
PVOID Reserved3;
UNICODE_STRING FullDllName;
BYTE Reserved4[8];
PVOID Reserved5[3];
union {
ULONG CheckSum;
PVOID Reserved6;
};
ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment