_PEB_LDR_DATA and _LDR_DATA_TABLE_ENTRY

Question 1

_PEB_LDR_DATA

Answer 1

All the linked lists contain the elements of type _LDR_DATA_TABLE_ENTRY. The term “module” here refers to any executable image, which includes the process executables and DLLs.

Question 2

_PEB_LDR_DATA - InLoadOrderModuleList

Answer 2

A linked list that organizes modules in the order in which they are loaded into a process. Because the process executable is always first to load in the process address space, its entry is first in this list.

Question 3

_PEB_LDR_DATA - InMemoryOrderModuleList

Answer 3

A linked list that organizes modules in the order in which they appear in the process’ virtual memory layout. For example, the last DLL to load may end up at a lower base address than the first (due to address space layour randomization [ASLR] and other factors).

Question 4

_PEB_LDR_DATA - InInitializationOrderModuleList

Answer 4

A linked list that organizes modules in the order in which their DllMain function was exectuted. This is different from the load order list because a module’s DllMain isn’t always called immediately when it loads. Sometimes it’s never called, for example when you load a DLL as a data file or image resource.

Question 5

_LDR_DATA_TABLE_ENTRY - DllBase

Answer 5

This is the base address of the module in process memory. The DLL dumping plugins read this address to know where to start carving.

Question 6

_LDR_DATA_TABLE_ENTRY - EntryPoint

Answer 6

The first instruction executed by the module. In most cases, it is taken from the PE file’s AddressOfEntryPoint value.

Question 7

_LDR_DATA_TABLE_ENTRY - SizeOfImage

Answer 7

The size of the module, in bytes.

Question 8

_LDR_DATA_TABLE_ENTRY - FullDllName

Answer 8

The full path to the module’s file on disk (for example, System32/kernel32.dll)

Question 9

_LDR_DATA_TABLE_ENTRY - BaseDllName

Answer 9

The base portion of the module’s filename(for example, kernel32.dll)

Question 10

_LDR_DATA_TABLE_ENTRY - LoadCount

Answer 10

The number of times LoadLibrary was called for the module. It is used as a reference count to know when it is safe to unload a DLL from process memory. Used to determine how a DLL was loaded (via the import address table (IAT) or an explicit call to LoadLibrary)