Min version | 2003/XP64 SP1 | Vista SP1 | 7 | 8 Pre RTM | 8 | 8.1 | 8.1 Update 1 | 10 Pre RTM |
---|---|---|---|---|---|---|---|---|
Max version | 2003/XP64 SP2 | Vista SP2 | 7 SP1 | 8.1 Update 1 | 10 TH2 | |||
x64 offset offset:bitpos | Field Name | |||||||
0x0000 | struct _LIST_ENTRY InLoadOrderLinks | |||||||
0x0010 | struct _LIST_ENTRY InMemoryOrderLinks | |||||||
0x0020 | struct _LIST_ENTRY InInitializationOrderLinks | struct _LIST_ENTRY InInitializationOrderLinks | struct _LIST_ENTRY InInitializationOrderLinks | |||||
0x0020 | struct _LIST_ENTRY InProgressLinks | |||||||
0x0030 | void * DllBase | |||||||
0x0038 | void * EntryPoint | |||||||
0x0040 | unsigned long SizeOfImage | |||||||
0x0048 | struct _UNICODE_STRING FullDllName | |||||||
0x0058 | struct _UNICODE_STRING BaseDllName | |||||||
0x0068 | unsigned long Flags | uint8_t[4] FlagGroup | ||||||
0x0068 | unsigned long Flags | |||||||
0x0068:0x00 | unsigned long PackagedBinary | |||||||
0x0068:0x01 | unsigned long MarkedForRemoval | |||||||
0x0068:0x02 | unsigned long ImageDll | |||||||
0x0068:0x03 | unsigned long LoadNotificationsSent | |||||||
0x0068:0x04 | unsigned long TelemetryEntryProcessed | |||||||
0x0068:0x05 | unsigned long ProcessStaticImport | |||||||
0x0068:0x06 | unsigned long InLegacyLists | |||||||
0x0068:0x07 | unsigned long InIndexes | |||||||
0x0068:0x08 | unsigned long ShimDll | |||||||
0x0068:0x09 | unsigned long InExceptionTable | |||||||
0x0068:0x0A | unsigned long ReservedFlags1 | |||||||
0x0068:0x0C | unsigned long LoadInProgress | |||||||
0x0068:0x0D | unsigned long ReservedFlags2 | unsigned long LoadConfigProcessed | ||||||
0x0068:0x0E | unsigned long EntryProcessed | |||||||
0x0068:0x0F | unsigned long ReservedFlags3 | unsigned long ProtectDelayLoad | ||||||
0x0068:0x10 | unsigned long ReservedFlags3 | |||||||
0x0068:0x12 | unsigned long DontCallForThreads | |||||||
0x0068:0x13 | unsigned long ProcessAttachCalled | |||||||
0x0068:0x14 | unsigned long ProcessAttachFailed | |||||||
0x0068:0x15 | unsigned long CorDeferredValidate | |||||||
0x0068:0x16 | unsigned long CorImage | |||||||
0x0068:0x17 | unsigned long DontRelocate | |||||||
0x0068:0x18 | unsigned long CorILOnly | |||||||
0x0068:0x19 | unsigned long ReservedFlags5 | |||||||
0x0068:0x1C | unsigned long Redirected | |||||||
0x0068:0x1D | unsigned long ReservedFlags6 | |||||||
0x0068:0x1F | unsigned long CompatDatabaseProcessed | |||||||
0x006C | uint16_t LoadCount | uint16_t ObsoleteLoadCount | ||||||
0x006E | uint16_t TlsIndex | |||||||
0x0070 | struct _LIST_ENTRY HashLinks | struct _LIST_ENTRY HashLinks | ||||||
0x0070 | void * SectionPointer | |||||||
0x0078 | unsigned long CheckSum | |||||||
0x0080 | unsigned long TimeDateStamp | unsigned long TimeDateStamp | ||||||
0x0080 | void * LoadedImports | |||||||
0x0088 | struct _ACTIVATION_CONTEXT * EntryPointActivationContext | |||||||
0x0090 | void * PatchInformation | void * Spare | void * Lock | |||||
0x0098 | struct _LIST_ENTRY ForwarderLinks | struct _LDR_DDAG_NODE * DdagNode | ||||||
0x00A0 | struct _LIST_ENTRY NodeModuleLink | |||||||
0x00A8 | struct _LIST_ENTRY ServiceTagLinks | |||||||
0x00B0 | struct _LDRP_DLL_SNAP_CONTEXT * SnapContext | struct _LDRP_LOAD_CONTEXT * LoadContext | ||||||
0x00B8 | struct _LIST_ENTRY StaticLinks | void * SwitchBackContext | void * ParentDllBase | |||||
0x00C0 | struct _RTL_BALANCED_NODE BaseAddressIndexNode | void * SwitchBackContext | ||||||
0x00C8 | void * ContextInformation | struct _RTL_BALANCED_NODE BaseAddressIndexNode | ||||||
0x00D0 | uint64_t OriginalBase | |||||||
0x00D8 | union _LARGE_INTEGER LoadTime | struct _RTL_BALANCED_NODE MappingInfoIndexNode | ||||||
0x00E0 | struct _RTL_BALANCED_NODE MappingInfoIndexNode | |||||||
0x00F0 | uint64_t OriginalBase | |||||||
0x00F8 | union _LARGE_INTEGER LoadTime | uint64_t OriginalBase | ||||||
0x0100 | unsigned long BaseNameHashValue | union _LARGE_INTEGER LoadTime | ||||||
0x0108 | unsigned long BaseNameHashValue | |||||||
0x010C | enum _LDR_DLL_LOAD_REASON LoadReason | |||||||
0x0110 | unsigned long ImplicitPathOptions | |||||||
0x0114 | unsigned long ReferenceCount |