LDR

pub const LDR = struct

File

Code

pub const LDR = struct {
    /// Microsoft documentation of this is incomplete, the fields here are taken from various resources including:
    ///  - https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb_ldr_data
    ///  - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntldr/ldr_data_table_entry.htm
    pub const DATA_TABLE_ENTRY = extern struct {
        InLoadOrderLinks: LIST_ENTRY,
        InMemoryOrderLinks: LIST_ENTRY,
        InInitializationOrderLinks: LIST_ENTRY,
        DllBase: PVOID,
        EntryPoint: PVOID,
        SizeOfImage: ULONG,
        FullDllName: UNICODE_STRING,
        BaseDllName: UNICODE_STRING,
        Reserved5: [3]PVOID,
        DUMMYUNIONNAME: extern union {
            CheckSum: ULONG,
            Reserved6: PVOID,
        },
        TimeDateStamp: ULONG,
    };

    pub const DLL_NOTIFICATION = struct {
        pub const REASON = enum(ULONG) { LOADED = 1, UNLOADED = 2 };

        pub const DATA = extern union {
            Loaded: LOADED,
            Unloaded: UNLOADED,

            pub const LOADED = extern struct {
                Flags: REGISTER,
                FullDllName: *const UNICODE_STRING,
                BaseDllName: *const UNICODE_STRING,
                DllBase: PVOID,
                SizeOfImage: ULONG,
            };

            pub const UNLOADED = extern struct {
                Flags: REGISTER,
                FullDllName: *const UNICODE_STRING,
                BaseDllName: *const UNICODE_STRING,
                DllBase: PVOID,
                SizeOfImage: ULONG,
            };
        };

        pub const COOKIE = *opaque {};

        pub const FUNCTION = fn (
            NotificationReason: REASON,
            NotificationData: *const DATA,
            Context: ?PVOID,
        ) callconv(.winapi) void;

        pub const REGISTER = packed struct(ULONG) {
            Reserved0: u32 = 0,
        };
    };

    pub const GET_DLL_HANDLE_EX = packed struct(ULONG) {
        UNCHANGED_REFCOUNT: bool = false,
        PIN: bool = false,
        Reserved2: u30 = 0,
    };

    pub const GET_PROCEDURE_ADDRESS = packed struct(ULONG) {
        DONT_RECORD_FORWARDER: bool = false,
        Reserved1: u31 = 0,
    };

    pub const LOAD = packed struct(ULONG) {
        DONT_RESOLVE_DLL_REFERENCES: bool = false,
        LIBRARY_AS_DATAFILE: bool = false,
        PACKAGED_LIBRARY: bool = false,
        WITH_ALTERED_SEARCH_PATH: bool = false,
        IGNORE_CODE_AUTHZ_LEVEL: bool = false,
        LIBRARY_AS_IMAGE_RESOURCE: bool = false,
        LIBRARY_AS_DATAFILE_EXCLUSIVE: bool = false,
        LIBRARY_REQUERE_SIGNED_TARGET: bool = false,
        LIBRARY_SEARCH_DLL_LOAD_DIR: bool = false,
        LIBRARY_SEARCH_USER_DIRS: bool = false,
        LIBRARY_SEARCH_SYSTEM32: bool = false,
        LIBRARY_SEARCH_DEFAULT_DIRS: bool = false,
    };
}