Signed-off-by: Paul Gofman pgofman@codeweavers.com --- Based on the data from here: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntldr/ldr_... Spotted while trying to examine the data pointed by DdagNode: the current definition gives incorrect offsets for fields after CheckSum.
include/winternl.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/include/winternl.h b/include/winternl.h index 466ade070c4..06a083e645a 100644 --- a/include/winternl.h +++ b/include/winternl.h @@ -3318,8 +3318,15 @@ typedef struct _LDR_DATA_TABLE_ENTRY ULONG Flags; SHORT LoadCount; SHORT TlsIndex; - HANDLE SectionHandle; - ULONG CheckSum; + union + { + LIST_ENTRY HashLinks; + struct + { + void *SectionPointer; + ULONG CheckSum; + }; + }; ULONG TimeDateStamp; HANDLE ActivationContext; void* Lock;