The PEB_LDR_DATA
structure is the main record of what modules are loaded in a process. It is essentially the head of three double-linked lists of LDR_DATA_TABLE_ENTRY
structures which each represent one loaded module.
Microsoft documentation of this is incomplete, the fields here are taken from various resources including:
- https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm
Fields
Length: ULONG,
The size in bytes of the structure
Initialized: BOOLEAN,
TRUE if the structure is prepared.
SsHandle: PVOID,
InLoadOrderModuleList: LIST_ENTRY,
InMemoryOrderModuleList: LIST_ENTRY,
InInitializationOrderModuleList: LIST_ENTRY,
EntryInProgress: PVOID,
No known use of this field is known in Windows 8 and higher.
ShutdownInProgress: BOOLEAN,
ShutdownThreadId: HANDLE,
Though ShutdownThreadId is declared as a HANDLE, it is indeed the thread ID as suggested by its name. It is picked up from the UniqueThread member of the CLIENT_ID in the TEB of the thread that asks to terminate the process.