| ... | ... | @@ -1312,11 +1312,37 @@ pub const PEB = extern struct { |
| 1312 | 1312 | CloudFileFlags: ULONG, |
| 1313 | 1313 | }; |
| 1314 | 1314 | |
| 1315 | | // TODO: https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm |
| 1315 | /// The `PEB_LDR_DATA` structure is the main record of what modules are loaded in a process. |
| 1316 | /// It is essentially the head of three double-linked lists of `LDR_DATA_TABLE_ENTRY` structures which each represent one loaded module. |
| 1317 | /// |
| 1318 | /// Microsoft documentation of this is incomplete, the fields here are taken from various resources including: |
| 1319 | /// - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm |
| 1316 | 1320 | pub const PEB_LDR_DATA = extern struct { |
| 1317 | | Reserved1: [8]BYTE, |
| 1318 | | Reserved2: [3]PVOID, |
| 1321 | // Versions: 3.51 and higher |
| 1322 | /// The size in bytes of the structure |
| 1323 | Length: ULONG, |
| 1324 | |
| 1325 | /// TRUE if the structure is prepared. |
| 1326 | Initialized: BOOLEAN, |
| 1327 | |
| 1328 | SsHandle: PVOID, |
| 1329 | InLoadOrderModuleList: LIST_ENTRY, |
| 1319 | 1330 | InMemoryOrderModuleList: LIST_ENTRY, |
| 1331 | InInitializationOrderModuleList: LIST_ENTRY, |
| 1332 | |
| 1333 | // Versions: 5.1 and higher |
| 1334 | |
| 1335 | /// No known use of this field is known in Windows 8 and higher. |
| 1336 | EntryInProgress: PVOID, |
| 1337 | |
| 1338 | // Versions: 6.0 from Windows Vista SP1, and higher |
| 1339 | ShutdownInProgress: BOOLEAN, |
| 1340 | |
| 1341 | /// Though ShutdownThreadId is declared as a HANDLE, |
| 1342 | /// it is indeed the thread ID as suggested by its name. |
| 1343 | /// It is picked up from the UniqueThread member of the CLIENT_ID in the |
| 1344 | /// TEB of the thread that asks to terminate the process. |
| 1345 | ShutdownThreadId: HANDLE, |
| 1320 | 1346 | }; |
| 1321 | 1347 | |
| 1322 | 1348 | pub const RTL_USER_PROCESS_PARAMETERS = extern struct { |