↓Skip to main content

Ldr field in PEB

·1 min
OffensiveSecurity ExploitDev WindowsInternal debugger

The Ldr is one of the most important field in PEB, Ldr is a pointer to a PEB_LDR_DATA structure that contains information about the loaded modules for the process.

It’s useful when developing a customized shellcode during exploit developement to find the address of an already loaded module. Also useful for malware development to find an address of already loaded module dynamically.

typedef struct _PEB_LDR_DATA {
  BYTE       Reserved1[8];
  PVOID      Reserved2[3];
  LIST_ENTRY InMemoryOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;