PEB, PEB_LDR_DATA, LDR_MODULE

typedef struct _PEB_LDR_DATA 
{ 
 ULONG Length; // +0x00 
 BOOLEAN Initialized; // +0x04 
 PVOID SsHandle; // +0x08 
 LIST_ENTRY InLoadOrderModuleList; // +0x0c 
 LIST_ENTRY InMemoryOrderModuleList; // +0x14 
 LIST_ENTRY InInitializationOrderModuleList;// +0x1c 
} PEB_LDR_DATA,*PPEB_LDR_DATA; // +0x24 
 
typedef struct _LDR_MODULE{ 
LIST_ENTRY          InLoadOrderModuleList;   +0x00 
LIST_ENTRY          InMemoryOrderModuleList; +0x08   
LIST_ENTRY          InInitializationOrderModuleList; +0x10 
void*               BaseAddress;  +0x18 
void*               EntryPoint;   +0x1c 
ULONG               SizeOfImage; 
UNICODE_STRING      FullDllName; 
UNICODE_STRING      BaseDllName; 
ULONG               Flags; 
SHORT               LoadCount; 
SHORT               TlsIndex; 
HANDLE              SectionHandle; 
ULONG               CheckSum; 
ULONG               TimeDateStamp; 
} LDR_MODULE, *PLDR_MODULE;

그림이 너무 좋아서. 출처 http://www.rohitab.com/discuss/topic/35251-3-ways-to-get-address-base-kernel32-from-peb/