LOADED_IMAGE

The LOADED_IMAGE structure contains information about the loaded image.

typedef struct _LOADED_IMAGE {
    PSTR ModuleName;
    HANDLE hFile;
    PUCHAR MappedAddress;
#ifdef _IMAGEHLP64
    PIMAGE_NT_HEADERS64 FileHeader;
#else
    PIMAGE_NT_HEADERS32 FileHeader;
#endif
    PIMAGE_SECTION_HEADER LastRvaSection;
    ULONG NumberOfSections;
    PIMAGE_SECTION_HEADER Sections;
    ULONG Characteristics;
    BOOLEAN fSystemImage;
    BOOLEAN fDOSImage;
    LIST_ENTRY Links;
    ULONG SizeOfImage;
} LOADED_IMAGE, *PLOADED_IMAGE;

Members

ModuleName

Pointer to a null-terminated string that specifies the file name of the mapped file.

hFile

Handle to the mapped file.

MappedAddress

Specifies the base address of the mapped file.

FileHeader

Pointer to an IMAGE_NT_HEADERS structure.

LastRvaSection

Pointer to an IMAGE_SECTION_HEADER structure.

NumberOfSections

Specifies the count of the COFF section headers.

Sections

Pointer to an IMAGE_SECTION_HEADER structure.

Characteristics

Specifies the image characteristics value.

Value	Meaning
IMAGE_FILE_RELOCS_STRIPPED	Relocation information is stripped from the file.
IMAGE_FILE_EXECUTABLE_IMAGE	The file is executable (there are no unresolved external references).
IMAGE_FILE_LINE_NUMS_STRIPPED	Line numbers are stripped from the file.
IMAGE_FILE_LOCAL_SYMS_STRIPPED	Local symbols are stripped from file.
IMAGE_FILE_AGGRESIVE_WS_TRIM	Aggressively trim the working set.
IMAGE_FILE_LARGE_ADDRESS_AWARE	The application can handle addresses larger than 2 GB.
IMAGE_FILE_BYTES_REVERSED_LO	Bytes of word are reversed.
IMAGE_FILE_32BIT_MACHINE	Computer supports 32-bit words.
IMAGE_FILE_DEBUG_STRIPPED	Debugging information is stored separately in a .dbg file.
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP	If the image is on removable media, copy and run from the swap file.
IMAGE_FILE_NET_RUN_FROM_SWAP	If the image is on the network, copy and run from the swap file.
IMAGE_FILE_SYSTEM	System file.
IMAGE_FILE_DLL	DLL file.
IMAGE_FILE_UP_SYSTEM_ONLY	File should be run only on a uniprocessor computer.
IMAGE_FILE_BYTES_REVERSED_HI	Bytes of the word are reversed.

fSystemImage

This value is TRUE if the image is a kernel mode executable image.

fDOSImage

This value is TRUE if the image is a 16-bit executable image.

Links

Specifies the list of loaded images.

SizeOfImage

Specifies the size of the image, in bytes.

Requirements

  Windows NT/2000: Requires Windows NT 3.51 or later.
  Windows 95/98: Requires Windows 95 or later. Available as a redistributable for Windows 95.
  Header: Declared in Dbghelp.h.

See Also

Debug Help Library Overview, DbgHelp Structures, IMAGE_NT_HEADERS, IMAGE_SECTION_HEADER, ImageLoad, MapAndLoad