| Min version | XP | XP SP2 | 2003/XP64 | Vista | 7 | 8 Pre RTM | 8 Pre RTM | 8.1 Update 1 | 8.1 Update 1 | 10 Pre RTM |
|---|---|---|---|---|---|---|---|---|---|---|
| Max version | XP SP1 | XP SP3 | 2003/XP64 SP2 | Vista SP2 | 7 SP1 | 8 | 10 TH2 | |||
| x86 offset offset:bitpos | Field Name | |||||||||
| 0x0000 | struct _LIST_ENTRY InLoadOrderLinks | |||||||||
| 0x0008 | struct _LIST_ENTRY InMemoryOrderLinks | |||||||||
| 0x0010 | struct _LIST_ENTRY InInitializationOrderLinks | struct _LIST_ENTRY InInitializationOrderLinks | struct _LIST_ENTRY InInitializationOrderLinks | |||||||
| 0x0010 | struct _LIST_ENTRY InProgressLinks | |||||||||
| 0x0018 | void * DllBase | |||||||||
| 0x001C | void * EntryPoint | |||||||||
| 0x0020 | unsigned long SizeOfImage | |||||||||
| 0x0024 | struct _UNICODE_STRING FullDllName | |||||||||
| 0x002C | struct _UNICODE_STRING BaseDllName | |||||||||
| 0x0034 | unsigned long Flags | uint8_t[4] FlagGroup | ||||||||
| 0x0034 | unsigned long Flags | |||||||||
| 0x0034:0x00 | unsigned long PackagedBinary | |||||||||
| 0x0034:0x01 | unsigned long MarkedForRemoval | |||||||||
| 0x0034:0x02 | unsigned long ImageDll | |||||||||
| 0x0034:0x03 | unsigned long LoadNotificationsSent | |||||||||
| 0x0034:0x04 | unsigned long TelemetryEntryProcessed | |||||||||
| 0x0034:0x05 | unsigned long ProcessStaticImport | |||||||||
| 0x0034:0x06 | unsigned long InLegacyLists | |||||||||
| 0x0034:0x07 | unsigned long InIndexes | |||||||||
| 0x0034:0x08 | unsigned long ShimDll | |||||||||
| 0x0034:0x09 | unsigned long InExceptionTable | |||||||||
| 0x0034:0x0A | unsigned long ReservedFlags1 | |||||||||
| 0x0034:0x0C | unsigned long LoadInProgress | |||||||||
| 0x0034:0x0D | unsigned long ReservedFlags2 | unsigned long LoadConfigProcessed | ||||||||
| 0x0034:0x0E | unsigned long EntryProcessed | |||||||||
| 0x0034:0x0F | unsigned long ReservedFlags3 | unsigned long ProtectDelayLoad | ||||||||
| 0x0034:0x10 | unsigned long ReservedFlags3 | |||||||||
| 0x0034:0x12 | unsigned long DontCallForThreads | |||||||||
| 0x0034:0x13 | unsigned long ProcessAttachCalled | |||||||||
| 0x0034:0x14 | unsigned long ProcessAttachFailed | |||||||||
| 0x0034:0x15 | unsigned long CorDeferredValidate | |||||||||
| 0x0034:0x16 | unsigned long CorImage | |||||||||
| 0x0034:0x17 | unsigned long DontRelocate | |||||||||
| 0x0034:0x18 | unsigned long CorILOnly | |||||||||
| 0x0034:0x19 | unsigned long ReservedFlags5 | |||||||||
| 0x0034:0x1C | unsigned long Redirected | |||||||||
| 0x0034:0x1D | unsigned long ReservedFlags6 | |||||||||
| 0x0034:0x1F | unsigned long CompatDatabaseProcessed | |||||||||
| 0x0038 | uint16_t LoadCount | uint16_t ObsoleteLoadCount | ||||||||
| 0x003A | uint16_t TlsIndex | |||||||||
| 0x003C | struct _LIST_ENTRY HashLinks | struct _LIST_ENTRY HashLinks | ||||||||
| 0x003C | void * SectionPointer | |||||||||
| 0x0040 | unsigned long CheckSum | |||||||||
| 0x0044 | unsigned long TimeDateStamp | unsigned long TimeDateStamp | ||||||||
| 0x0044 | void * LoadedImports | |||||||||
| 0x0048 | void * EntryPointActivationContext | struct _ACTIVATION_CONTEXT * EntryPointActivationContext | ||||||||
| 0x004C | void * PatchInformation | void * Spare | void * Lock | |||||||
| 0x0050 | struct _LIST_ENTRY ForwarderLinks | struct _LDR_DDAG_NODE * DdagNode | ||||||||
| 0x0054 | struct _LIST_ENTRY NodeModuleLink | |||||||||
| 0x0058 | struct _LIST_ENTRY ServiceTagLinks | |||||||||
| 0x005C | struct _LDRP_DLL_SNAP_CONTEXT * SnapContext | struct _LDRP_LOAD_CONTEXT * LoadContext | ||||||||
| 0x0060 | struct _LIST_ENTRY StaticLinks | void * SwitchBackContext | void * ParentDllBase | |||||||
| 0x0064 | struct _RTL_BALANCED_NODE BaseAddressIndexNode | void * SwitchBackContext | ||||||||
| 0x0068 | void * ContextInformation | struct _RTL_BALANCED_NODE BaseAddressIndexNode | ||||||||
| 0x006C | unsigned long OriginalBase | |||||||||
| 0x0070 | union _LARGE_INTEGER LoadTime | struct _RTL_BALANCED_NODE MappingInfoIndexNode | ||||||||
| 0x0074 | struct _RTL_BALANCED_NODE MappingInfoIndexNode | |||||||||
| 0x007C | unsigned long OriginalBase | |||||||||
| 0x0080 | union _LARGE_INTEGER LoadTime | unsigned long OriginalBase | ||||||||
| 0x0088 | unsigned long BaseNameHashValue | union _LARGE_INTEGER LoadTime | ||||||||
| 0x0090 | unsigned long BaseNameHashValue | |||||||||
| 0x0094 | enum _LDR_DLL_LOAD_REASON LoadReason | |||||||||
| 0x0098 | unsigned long ImplicitPathOptions | |||||||||
| 0x009C | unsigned long ReferenceCount | |||||||||