Describes a user-mode or kernel-mode module. More...

#include <intro_types.h>

Data Fields
BOOLEAN	Valid
	Set to True if the information in the structure is valid, False otherwise. More...

QWORD	Base
	The guest linear address at which the module is loaded. More...

DWORD	Size

DWORD	TimeDateStamp
	The value of the time date stamp field in the MZPE headers of a Windows module. More...

WCHAR	Name [ALERT_PATH_MAX_LEN]
	The name of the module. More...

WCHAR	Path [ALERT_PATH_MAX_LEN]
	The full path of the module. More...

Detailed Description

Describes a user-mode or kernel-mode module.

Since certain operations that fill the fields in this structure may fail, the Valid field should be checked before using any information present in the structure.

Definition at line 925 of file intro_types.h.

Field Documentation

◆ Base

QWORD _INTRO_MODULE::Base

The guest linear address at which the module is loaded.

Definition at line 929 of file intro_types.h.

◆ Name

WCHAR _INTRO_MODULE::Name[ALERT_PATH_MAX_LEN]

The name of the module.

Definition at line 933 of file intro_types.h.

◆ Path

WCHAR _INTRO_MODULE::Path[ALERT_PATH_MAX_LEN]

The full path of the module.

Definition at line 934 of file intro_types.h.

◆ Size

DWORD _INTRO_MODULE::Size

The size of the module.

Definition at line 930 of file intro_types.h.

◆ TimeDateStamp

DWORD _INTRO_MODULE::TimeDateStamp

The value of the time date stamp field in the MZPE headers of a Windows module.

Definition at line 932 of file intro_types.h.

◆ Valid

BOOLEAN _INTRO_MODULE::Valid

Set to True if the information in the structure is valid, False otherwise.

Definition at line 928 of file intro_types.h.

Referenced by IntWinSelfMapHandleCr3SelfMapModification().

The documentation for this struct was generated from the following file:

include/public/intro_types.h

Data Fields