Struct LdrDataTableEntry

pub struct LdrDataTableEntry { /* private fields */ }

This structure exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY, the structure used by the Windows loader to describe a module loaded in the current process.

These entries can be enumerated through super::PEB::entries.

Implementations

impl LdrDataTableEntry

pub fn dll_base(&self) -> u64

Base address at which the module is mapped in memory (DllBase).

pub fn entry_point(&self) -> u64

Address of the entry point of the module (EntryPoint).

pub fn size_of_image(&self) -> u32

Size (in bytes) of the module’s image in memory (SizeOfImage).

pub fn full_dll_name(&self) -> String

Full path of the module (FullDllName), e.g. C:\Windows\System32\ntdll.dll.

pub fn base_dll_name(&self) -> String

Base name of the module (BaseDllName), e.g. ntdll.dll.

pub fn flags(&self) -> u32

Loader flags describing the state of the module (Flags).

pub fn obsolete_load_count(&self) -> u16

Legacy load count of the module (ObsoleteLoadCount). Superseded by LdrDataTableEntry::reference_count on Windows 8 and later.

pub fn tls_index(&self) -> u16

TLS slot index assigned to the module, or 0 when it has no TLS (TlsIndex).

pub fn time_date_stamp(&self) -> u32

TimeDateStamp of the module as cached by the loader.

pub fn entry_point_activation_context(&self) -> u64

Address of the activation context associated with the module’s entry point.

pub fn lock(&self) -> u64

Address of the per-entry loader lock.

pub fn ddag_node(&self) -> Option<u64>

Address of the dependency-graph node of the module (DdagNode).

Available on Windows 8 and later.

pub fn load_context(&self) -> Option<u64>

Address of the loader context used while the module is being snapped

Available on Windows 8 and later.

pub fn parent_dll_base(&self) -> Option<u64>

Base address of the module that triggered the load of this one.

Available on Windows 8 and later.

pub fn switch_back_context(&self) -> Option<u64>

Address of the CHPE switch-back context.

Available on Windows 8 and later.

pub fn original_base(&self) -> Option<u64>

Preferred base address recorded in the PE headers

Available on Windows 8 and later.

pub fn load_time(&self) -> Option<i64>

Time at which the module was loaded.

Available on Windows 8 and later.

pub fn base_name_hash_value(&self) -> Option<u32>

Hash of the module’s base name used to index the loader tables

Available on Windows 8 and later.

pub fn load_reason(&self) -> Option<i32>

Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value

Available on Windows 8 and later.

pub fn implicit_path_options(&self) -> Option<u32>

Path-search options implied when the module was resolved

Available on Windows 8 and later.

pub fn reference_count(&self) -> Option<u32>

Number of references currently held on the module.

Available on Windows 8 and later.

pub fn dependent_load_flags(&self) -> Option<u32>

Flags controlling how the statically-linked dependencies of the module are loaded.

Available on Windows 8 and later.

pub fn signing_level(&self) -> Option<u8>

Signing level of the module’s image, as a SE_SIGNING_LEVEL value

Available on Windows 10 and later.

pub fn check_sum(&self) -> Option<u32>

Image checksum cached by the loader

Available on Windows 10 and later.

pub fn active_patch_image_base(&self) -> Option<u64>

Base address of the active hot-patch image, if any.

Available on Windows 11 and later.

pub fn hot_patch_state(&self) -> Option<u32>

State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value.

Available on Windows 11 and later.

Trait Implementations

impl Display for LdrDataTableEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.