-1

Is there a struct PEB_LDR_DATA in the PEB of every process? What is the offset address of this struct in PEB? How can I find the list of loaded modules(such as kernel32.dll) from the base address of this struct?

Thanks!

2

1 Answer 1

0

Thanks to user2120666, I finally discovered how to locate kernel32.dll in struct PEB_LDR_DATA.

It has to be noticed that in WINDOWS7, the first node in InInitializationOrderModuleList is kernelbase.dll rather than ntdll.dll. The offset address has to be modified respectively.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.