LOADED_IMAGE

The LOADED_IMAGE structure contains information about the loaded image.

typedef struct _LOADED_IMAGE {
    LPSTR ModuleName;
    HANDLE hFile;
    PUCHAR MappedAddress;
    PIMAGE_NT_HEADERS FileHeader;
    PIMAGE_SECTION_HEADER LastRvaSection;
    ULONG NumberOfSections;
    PIMAGE_SECTION_HEADER Sections;
    ULONG Characteristics;
    BOOLEAN fSystemImage;
    BOOLEAN fDOSImage;
    LIST_ENTRY Links;
    ULONG SizeOfImage;
} LOADED_IMAGE, *PLOADED_IMAGE;
 

Members

ModuleName

Pointer to a null-terminated string that specifies the filename of the mapped file.

hFile

Handle to the mapped file.

MappedAddress

Specifies the base address of the mapped file.

FileHeader

Pointer to the NT headers.

LastRvaSection

Pointer to the first COFF section header.

NumberOfSections

Specifies the count of the COFF section headers.

Sections

Pointer to the first COFF section header.

Characteristics

Specifies the image characteristics value.

fSystemImage

This value is TRUE if the image is a kernel mode executable image.

fDOSImage

This value is TRUE if the image is a 16-bit executable image.

Links

Specifies the list of loaded images.

SizeOfImage

Specifies the size of the image.

QuickInfo

  Windows NT: Requires version 3.51 or later.
  Windows: Requires Windows 95 or later. Available as a redistributable for Windows 95.
  Windows CE: Unsupported.
  Header: Declared in imagehlp.h.

See Also

PE Image Helper (ImageHlp) Overview, Image Integrity, ImageLoad, MapAndLoad