@@ -1312,11 +1312,37 @@ pub const PEB = extern struct {
1312
1312
CloudFileFlags : ULONG ,
1313
1313
};
1314
1314
1315
- // TODO: https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
1315
+ /// The `PEB_LDR_DATA` structure is the main record of what modules are loaded in a process.
1316
+ /// It is essentially the head of three double-linked lists of `LDR_DATA_TABLE_ENTRY` structures which each represent one loaded module.
1317
+ ///
1318
+ /// Microsoft documentation of this is incomplete, the fields here are taken from various resources including:
1319
+ /// - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
1316
1320
pub const PEB_LDR_DATA = extern struct {
1317
- Reserved1 : [8 ]BYTE ,
1318
- Reserved2 : [3 ]PVOID ,
1321
+ // Versions: 3.51 and higher
1322
+ /// The size in bytes of the structure
1323
+ Length : ULONG ,
1324
+
1325
+ /// TRUE if the structure is prepared.
1326
+ Initialized : BOOLEAN ,
1327
+
1328
+ SsHandle : PVOID ,
1329
+ InLoadOrderModuleList : LIST_ENTRY ,
1319
1330
InMemoryOrderModuleList : LIST_ENTRY ,
1331
+ InInitializationOrderModuleList : LIST_ENTRY ,
1332
+
1333
+ // Versions: 5.1 and higher
1334
+
1335
+ /// No known use of this field is known in Windows 8 and higher.
1336
+ EntryInProgress : PVOID ,
1337
+
1338
+ // Versions: 6.0 from Windows Vista SP1, and higher
1339
+ ShutdownInProgress : BOOLEAN ,
1340
+
1341
+ /// Though ShutdownThreadId is declared as a HANDLE,
1342
+ /// it is indeed the thread ID as suggested by its name.
1343
+ /// It is picked up from the UniqueThread member of the CLIENT_ID in the
1344
+ /// TEB of the thread that asks to terminate the process.
1345
+ ShutdownThreadId : HANDLE ,
1320
1346
};
1321
1347
1322
1348
pub const RTL_USER_PROCESS_PARAMETERS = extern struct {
0 commit comments