Geoff Chappell - Software Analyst
An array of RTL_MODULE_BASIC_INFO structures is produced in the output buffer by a successful call to the RtlQueryModuleInformation function when given this structure’s size to indicate what information is sought.
The RTL_MODULE_BASIC_INFO structure is not documented.
The RTL_MODULE_BASIC_INFO is 0x04 or 0x08 bytes in 32-bit and 64-bit Windows, respectively, in all versions from 6.0 until at least the 2004 release of Windows 10.
Offset | Definition |
---|---|
0x00 |
PVOID ImageBase; |