The PEB_LDR_DATA structure is the main record of what modules are loaded in a process. It is essentially the head of three double-linked lists of LDR_DATA_TABLE_ENTRY structures which each represent one loaded module.

Microsoft documentation of this is incomplete, the fields here are taken from various resources including:

  • https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm

Fields

Length: ULONG,

The size in bytes of the structure

Initialized: BOOLEAN,

TRUE if the structure is prepared.

SsHandle: PVOID,
InLoadOrderModuleList: LIST_ENTRY,
InMemoryOrderModuleList: LIST_ENTRY,
InInitializationOrderModuleList: LIST_ENTRY,
EntryInProgress: PVOID,

No known use of this field is known in Windows 8 and higher.

ShutdownInProgress: BOOLEAN,
ShutdownThreadId: HANDLE,

Though ShutdownThreadId is declared as a HANDLE, it is indeed the thread ID as suggested by its name. It is picked up from the UniqueThread member of the CLIENT_ID in the TEB of the thread that asks to terminate the process.