Undocumented functions of NTDLL



SYSTEM_MODULE
SYSTEM_MODULE

typedef struct _SYSTEM_MODULE {

ULONG Reserved1; ULONG Reserved2; PVOID ImageBaseAddress; ULONG ImageSize; ULONG Flags; WORD Id; WORD Rank; WORD w018; WORD NameOffset; BYTE Name[MAXIMUM_FILENAME_LENGTH];

} SYSTEM_MODULE, *PSYSTEM_MODULE;


Reserved1
Reserved (always 0xBAADF00D).
Reserved2
Reserved (always 0).
Address
Module address in virtual address space.
ImageSize
Size of module in virtual address space.
Flags
- ???
Id
0-based counter of results.
Rank
The same as Id (in global enumeration with NtQuerySystemInformation), or unknown.
w018
In process module enumeration with LdrQueryProcessModuleInformation always 0xFFFF, in other - unknown.
NameOffset
Offset in Name table to first char of module name.
Name
Path to module.


Requirements:
Library: ntdll.lib




See also:
KMODULE
SYSTEM_MODULE_INFORMATION
LdrQueryProcessModuleInformation
NtQuerySystemInformation