Undocumented functions of NTOSKRNL


KMODULE
KMODULE

typedef struct _KMODULE {



  LIST_ENTRY          KernelLoadedModuleList;     // _PsLoadedModuleList if last
  DWORD               d008;
  DWORD               d00C;
  PVOID               p010;
  DWORD               p014;
  PVOID               ImageBase;
  PVOID               EntryPoint;
  DWORD               d020;
  UNICODE_STRING      Path;
  UNICODE_STRING      ModuleName;

} KMODULE, *PKMODULE;


KernelLoadedModuleList
List begin from _PsLoadedModuleList.
sPath
System path to image file.
sModuleName
Module name, typically file name from sPath.


Requirements:
Library: ntoskrnl.lib



See also: