Min version2003/XP64 SP1Vista SP178 Pre RTM88.18.1 Update 110 Pre RTM
Max version2003/XP64 SP2Vista SP27 SP18.1 Update 110 TH2
x64 offset
offset:bitpos
Field Name
0x0000struct _LIST_ENTRY
InLoadOrderLinks
0x0010struct _LIST_ENTRY
InMemoryOrderLinks
0x0020struct _LIST_ENTRY
InInitializationOrderLinks
struct _LIST_ENTRY
InInitializationOrderLinks
struct _LIST_ENTRY
InInitializationOrderLinks
0x0020struct _LIST_ENTRY
InProgressLinks
0x0030void *
DllBase
0x0038void *
EntryPoint
0x0040unsigned long
SizeOfImage
0x0048struct _UNICODE_STRING
FullDllName
0x0058struct _UNICODE_STRING
BaseDllName
0x0068unsigned long
Flags
uint8_t[4]
FlagGroup
0x0068unsigned long
Flags
0x0068:0x00unsigned long
PackagedBinary
0x0068:0x01unsigned long
MarkedForRemoval
0x0068:0x02unsigned long
ImageDll
0x0068:0x03unsigned long
LoadNotificationsSent
0x0068:0x04unsigned long
TelemetryEntryProcessed
0x0068:0x05unsigned long
ProcessStaticImport
0x0068:0x06unsigned long
InLegacyLists
0x0068:0x07unsigned long
InIndexes
0x0068:0x08unsigned long
ShimDll
0x0068:0x09unsigned long
InExceptionTable
0x0068:0x0Aunsigned long
ReservedFlags1
0x0068:0x0Cunsigned long
LoadInProgress
0x0068:0x0Dunsigned long
ReservedFlags2
unsigned long
LoadConfigProcessed
0x0068:0x0Eunsigned long
EntryProcessed
0x0068:0x0Funsigned long
ReservedFlags3
unsigned long
ProtectDelayLoad
0x0068:0x10unsigned long
ReservedFlags3
0x0068:0x12unsigned long
DontCallForThreads
0x0068:0x13unsigned long
ProcessAttachCalled
0x0068:0x14unsigned long
ProcessAttachFailed
0x0068:0x15unsigned long
CorDeferredValidate
0x0068:0x16unsigned long
CorImage
0x0068:0x17unsigned long
DontRelocate
0x0068:0x18unsigned long
CorILOnly
0x0068:0x19unsigned long
ReservedFlags5
0x0068:0x1Cunsigned long
Redirected
0x0068:0x1Dunsigned long
ReservedFlags6
0x0068:0x1Funsigned long
CompatDatabaseProcessed
0x006Cuint16_t
LoadCount
uint16_t
ObsoleteLoadCount
0x006Euint16_t
TlsIndex
0x0070struct _LIST_ENTRY
HashLinks
struct _LIST_ENTRY
HashLinks
0x0070void *
SectionPointer
0x0078unsigned long
CheckSum
0x0080unsigned long
TimeDateStamp
unsigned long
TimeDateStamp
0x0080void *
LoadedImports
0x0088struct _ACTIVATION_CONTEXT *
EntryPointActivationContext
0x0090void *
PatchInformation
void *
Spare
void *
Lock
0x0098struct _LIST_ENTRY
ForwarderLinks
struct _LDR_DDAG_NODE *
DdagNode
0x00A0struct _LIST_ENTRY
NodeModuleLink
0x00A8struct _LIST_ENTRY
ServiceTagLinks
0x00B0struct _LDRP_DLL_SNAP_CONTEXT *
SnapContext
struct _LDRP_LOAD_CONTEXT *
LoadContext
0x00B8struct _LIST_ENTRY
StaticLinks
void *
SwitchBackContext
void *
ParentDllBase
0x00C0struct _RTL_BALANCED_NODE
BaseAddressIndexNode
void *
SwitchBackContext
0x00C8void *
ContextInformation
struct _RTL_BALANCED_NODE
BaseAddressIndexNode
0x00D0uint64_t
OriginalBase
0x00D8union _LARGE_INTEGER
LoadTime
struct _RTL_BALANCED_NODE
MappingInfoIndexNode
0x00E0struct _RTL_BALANCED_NODE
MappingInfoIndexNode
0x00F0uint64_t
OriginalBase
0x00F8union _LARGE_INTEGER
LoadTime
uint64_t
OriginalBase
0x0100unsigned long
BaseNameHashValue
union _LARGE_INTEGER
LoadTime
0x0108unsigned long
BaseNameHashValue
0x010Cenum _LDR_DLL_LOAD_REASON
LoadReason
0x0110unsigned long
ImplicitPathOptions
0x0114unsigned long
ReferenceCount