typedef struct _SYSTEM_MODULE {
ULONG Reserved1;
ULONG Reserved2;
PVOID ImageBaseAddress;
ULONG ImageSize;
ULONG Flags;
WORD Id;
WORD Rank;
WORD w018;
WORD NameOffset;
BYTE Name[MAXIMUM_FILENAME_LENGTH];
} SYSTEM_MODULE, *PSYSTEM_MODULE;
Reserved1
Reserved (always 0xBAADF00D).Reserved2
Reserved (always 0).Address
Module address in virtual address space.ImageSize
Size of module in virtual address space.Flags
- ???Id
0-based counter of results.Rank
The same as Id (in global enumeration with NtQuerySystemInformation), or unknown.w018
In process module enumeration with LdrQueryProcessModuleInformation always 0xFFFF, in other - unknown.NameOffset
Offset in Name table to first char of module name.Name
Path to module.