C++中:
(PVOID64)(Ldr64 + offsetof(PEB_LDR_DATA64, InLoadOrderModuleList))
//------------------------------------------------------------------
delphi中两种实现方法:
var
Ldr64: PEB_LDR_DATA64;
//1,
PVOID64(NativeUInt(@Ldr64)+NativeUInt(@PEB_LDR_DATA64(nil^).InLoadOrderModuleList))
//2,
@Ldr64.InLoadOrderModuleList;
结果:
//Ldr64=$18F2CC
//Ldr64.InLoadOrderModuleList=$18F2D8
//注:上面两种方法计算出来的偏移地址都是一样的。