Min version | XP | XP SP2 | 2003/XP64 | 2003/XP64 SP1 | Vista | Vista SP1 | 7 | 8 Pre RTM | 8 Pre RTM | 8 | 8.1 Update 1 | 8.1 | 8.1 Update 1 | 10 Pre RTM | |||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Max version | XP SP1 | XP SP3 | 2003/XP64 SP2 | Vista SP2 | 7 SP1 | 8 | 8.1 Update 1 | 10 TH2 | |||||||||||
Architecture | x86 | x86 | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 | |
x86 offset offset:bitpos | Field Name | x64 offset offset:bitpos | |||||||||||||||||
0x0000 | struct _LIST_ENTRY InLoadOrderLinks | 0x0000 | |||||||||||||||||
0x0008 | struct _LIST_ENTRY InMemoryOrderLinks | 0x0010 | |||||||||||||||||
0x0010 | struct _LIST_ENTRY InInitializationOrderLinks | struct _LIST_ENTRY InInitializationOrderLinks | struct _LIST_ENTRY InInitializationOrderLinks | 0x0020 | |||||||||||||||
0x0010 | struct _LIST_ENTRY InProgressLinks | 0x0020 | |||||||||||||||||
0x0018 | void * DllBase | 0x0030 | |||||||||||||||||
0x001C | void * EntryPoint | 0x0038 | |||||||||||||||||
0x0020 | unsigned long SizeOfImage | 0x0040 | |||||||||||||||||
0x0024 | struct _UNICODE_STRING FullDllName | 0x0048 | |||||||||||||||||
0x002C | struct _UNICODE_STRING BaseDllName | 0x0058 | |||||||||||||||||
0x0034 | unsigned long Flags | uint8_t[4] FlagGroup | 0x0068 | ||||||||||||||||
0x0034 | unsigned long Flags | 0x0068 | |||||||||||||||||
0x0034:0x00 | unsigned long PackagedBinary | 0x0068:0x00 | |||||||||||||||||
0x0034:0x01 | unsigned long MarkedForRemoval | 0x0068:0x01 | |||||||||||||||||
0x0034:0x02 | unsigned long ImageDll | 0x0068:0x02 | |||||||||||||||||
0x0034:0x03 | unsigned long LoadNotificationsSent | 0x0068:0x03 | |||||||||||||||||
0x0034:0x04 | unsigned long TelemetryEntryProcessed | 0x0068:0x04 | |||||||||||||||||
0x0034:0x05 | unsigned long ProcessStaticImport | 0x0068:0x05 | |||||||||||||||||
0x0034:0x06 | unsigned long InLegacyLists | 0x0068:0x06 | |||||||||||||||||
0x0034:0x07 | unsigned long InIndexes | 0x0068:0x07 | |||||||||||||||||
0x0034:0x08 | unsigned long ShimDll | 0x0068:0x08 | |||||||||||||||||
0x0034:0x09 | unsigned long InExceptionTable | 0x0068:0x09 | |||||||||||||||||
0x0034:0x0A | unsigned long ReservedFlags1 | 0x0068:0x0A | |||||||||||||||||
0x0034:0x0C | unsigned long LoadInProgress | 0x0068:0x0C | |||||||||||||||||
0x0034:0x0D | unsigned long ReservedFlags2 | unsigned long LoadConfigProcessed | 0x0068:0x0D | ||||||||||||||||
0x0034:0x0E | unsigned long EntryProcessed | 0x0068:0x0E | |||||||||||||||||
0x0034:0x0F | unsigned long ReservedFlags3 | unsigned long ProtectDelayLoad | 0x0068:0x0F | ||||||||||||||||
0x0034:0x10 | unsigned long ReservedFlags3 | 0x0068:0x10 | |||||||||||||||||
0x0034:0x12 | unsigned long DontCallForThreads | 0x0068:0x12 | |||||||||||||||||
0x0034:0x13 | unsigned long ProcessAttachCalled | 0x0068:0x13 | |||||||||||||||||
0x0034:0x14 | unsigned long ProcessAttachFailed | 0x0068:0x14 | |||||||||||||||||
0x0034:0x15 | unsigned long CorDeferredValidate | 0x0068:0x15 | |||||||||||||||||
0x0034:0x16 | unsigned long CorImage | 0x0068:0x16 | |||||||||||||||||
0x0034:0x17 | unsigned long DontRelocate | 0x0068:0x17 | |||||||||||||||||
0x0034:0x18 | unsigned long CorILOnly | 0x0068:0x18 | |||||||||||||||||
0x0034:0x19 | unsigned long ReservedFlags5 | 0x0068:0x19 | |||||||||||||||||
0x0034:0x1C | unsigned long Redirected | 0x0068:0x1C | |||||||||||||||||
0x0034:0x1D | unsigned long ReservedFlags6 | 0x0068:0x1D | |||||||||||||||||
0x0034:0x1F | unsigned long CompatDatabaseProcessed | 0x0068:0x1F | |||||||||||||||||
0x0038 | uint16_t LoadCount | uint16_t ObsoleteLoadCount | 0x006C | ||||||||||||||||
0x003A | uint16_t TlsIndex | 0x006E | |||||||||||||||||
0x003C | struct _LIST_ENTRY HashLinks | struct _LIST_ENTRY HashLinks | 0x0070 | ||||||||||||||||
0x003C | void * SectionPointer | 0x0070 | |||||||||||||||||
0x0040 | unsigned long CheckSum | 0x0078 | |||||||||||||||||
0x0044 | unsigned long TimeDateStamp | unsigned long TimeDateStamp | 0x0080 | ||||||||||||||||
0x0044 | void * LoadedImports | 0x0080 | |||||||||||||||||
0x0048 | void * EntryPointActivationContext | struct _ACTIVATION_CONTEXT * EntryPointActivationContext | 0x0088 | ||||||||||||||||
0x004C | void * PatchInformation | void * Spare | void * Lock | 0x0090 | |||||||||||||||
0x0050 | struct _LIST_ENTRY ForwarderLinks | struct _LDR_DDAG_NODE * DdagNode | 0x0098 | ||||||||||||||||
0x0054 | struct _LIST_ENTRY NodeModuleLink | 0x00A0 | |||||||||||||||||
0x0058 | struct _LIST_ENTRY ServiceTagLinks | 0x00A8 | |||||||||||||||||
0x005C | struct _LDRP_DLL_SNAP_CONTEXT * SnapContext | struct _LDRP_LOAD_CONTEXT * LoadContext | 0x00B0 | ||||||||||||||||
0x0060 | struct _LIST_ENTRY StaticLinks | void * SwitchBackContext | void * ParentDllBase | 0x00B8 | |||||||||||||||
0x0064 | struct _RTL_BALANCED_NODE BaseAddressIndexNode | void * SwitchBackContext | 0x00C0 | ||||||||||||||||
0x0068 | void * ContextInformation | struct _RTL_BALANCED_NODE BaseAddressIndexNode | 0x00C8 | ||||||||||||||||
0x006C | uintptr_t OriginalBase | 0x00D0 | |||||||||||||||||
0x0070 | union _LARGE_INTEGER LoadTime | union _LARGE_INTEGER LoadTime | struct _RTL_BALANCED_NODE MappingInfoIndexNode | 0x00D8 | |||||||||||||||
0x0074 | struct _RTL_BALANCED_NODE MappingInfoIndexNode | 0x00E0 | |||||||||||||||||
0x007C | uintptr_t OriginalBase | 0x00F0 | |||||||||||||||||
0x0080 | union _LARGE_INTEGER LoadTime | uintptr_t OriginalBase | 0x00F8 | ||||||||||||||||
0x0088 | unsigned long BaseNameHashValue | union _LARGE_INTEGER LoadTime | 0x0100 | ||||||||||||||||
0x0090 | unsigned long BaseNameHashValue | 0x0108 | |||||||||||||||||
0x0094 | enum _LDR_DLL_LOAD_REASON LoadReason | 0x010C | |||||||||||||||||
0x0098 | unsigned long ImplicitPathOptions | 0x0110 | |||||||||||||||||
0x009C | unsigned long ReferenceCount | 0x0114 |