Struct LdrDataTableEntry 

#[repr(C)]
pub struct LdrDataTableEntry {
    pub in_load_order_links: ListEntry,
    pub in_memory_order_links: ListEntry,
    pub in_initialization_order_links: ListEntry,
    pub dll_base: NativePtr,
    pub entry_point: NativePtr,
    pub size_of_image: u32,
    pub full_dll_name: UnicodeString,
    pub base_dll_name: UnicodeString,
}

LDR_DATA_TABLE_ENTRY - represents a loaded module

this is a simplified version; full structure has more fields that vary by Windows version

Fields

in_load_order_links: ListEntry

in_memory_order_links: ListEntry

in_initialization_order_links: ListEntry

dll_base: NativePtr

entry_point: NativePtr

size_of_image: u32

full_dll_name: UnicodeString

base_dll_name: UnicodeString

Implementations

impl LdrDataTableEntry

pub fn base(&self) -> usize

get module base address

pub fn size(&self) -> usize

get module size

pub fn entry_point(&self) -> usize

get entry point address

pub unsafe fn full_name(&self) -> String

get full path as String

Safety

full_dll_name buffer must be valid

pub unsafe fn base_name(&self) -> String

get base name (filename only) as String

Safety

base_dll_name buffer must be valid

pub fn contains_address(&self, addr: usize) -> bool

check if address is within this module

pub unsafe fn matches_name(&self, name: &str) -> bool

check if this module matches a name (case-insensitive)

Safety

name buffers must be valid