PLDR_DATA_TABLE_ENTRY LdrpAllocateDataTableEntry ( IN PVOID DllBase ) /*++ Routine Description: This function allocates an entry in the loader data table. If the table is going to overflow, then a new table is allocated. Arguments: DllBase - Supplies the address of the base of the DLL Image. be added to the loader data table. Return Value: Returns the address of the allocated loader data table entry --*/ { PLDR_DATA_TABLE_ENTRY Entry; PIMAGE_NT_HEADERS NtHeaders; NtHeaders = RtlImageNtHeader(DllBase); Entry = NULL; if ( NtHeaders ) { Entry = RtlAllocateHeap(RtlProcessHeap(),MAKE_TAG( LDR_TAG ) | HEAP_ZERO_MEMORY,sizeof( *Entry )); if ( Entry ) { Entry->DllBase = DllBase; Entry->SizeOfImage = NtHeaders->OptionalHeader.SizeOfImage; Entry->TimeDateStamp = NtHeaders->FileHeader.TimeDateStamp; } } return Entry; } VOID LdrpInsertMemoryTableEntry ( IN PLDR_DATA_TABLE_ENTRY LdrDataTableEntry ) /*++ Routine Description: This function inserts a loader data table entry into the list of loaded modules for this process. The insertion is done in "image memory base order". Arguments: LdrDataTableEntry - Supplies the address of the loader data table entry to insert in the list of loaded modules for this process. Return Value: None. --*/ { PPEB_LDR_DATA Ldr; ULONG i; Ldr = NtCurrentPeb()->Ldr; i = LDRP_COMPUTE_HASH_INDEX(LdrDataTableEntry->BaseDllName.Buffer[0]); InsertTailList(&LdrpHashTable[i],&LdrDataTableEntry->HashLinks); // KHM KHM KHM ;) InsertTailList(&Ldr->InLoadOrderModuleList, &LdrDataTableEntry->InLoadOrderLinks); InsertTailList(&Ldr->InMemoryOrderModuleList, &LdrDataTableEntry->InMemoryOrderLinks); }