SYSTEM_MODULE

typedef struct _SYSTEM_MODULE {




  ULONG                Reserved1;
  ULONG                Reserved2;
  PVOID                ImageBaseAddress;
  ULONG                ImageSize;
  ULONG                Flags;
  WORD                 Id;
  WORD                 Rank;
  WORD                 w018;
  WORD                 NameOffset;
  BYTE                 Name[MAXIMUM_FILENAME_LENGTH];


} SYSTEM_MODULE, *PSYSTEM_MODULE;

Reserved1

Reserved (always 0xBAADF00D).

Reserved2

Reserved (always 0).

Address

Module address in virtual address space.

ImageSize

Size of module in virtual address space.

Flags

- ???

Id

0-based counter of results.

Rank

The same as Id (in global enumeration with NtQuerySystemInformation), or unknown.

w018

In process module enumeration with LdrQueryProcessModuleInformation always 0xFFFF, in other - unknown.

NameOffset

Offset in Name table to first char of module name.

Name

Path to module.

Requirements:

Library: ntdll.lib

Undocumented functions of NTDLL