I've been implementing some Windows internals code and when I have tried to document this structure I have not been able to do so because of those two members. I can't find anything about them.

This is the definition of the structure I'm talking about:

typedef struct _PEB_LDR_DATA {
    DWORD      dwLength;
    DWORD      dwInitialized;
    LPVOID     lpSsHandle;
    LIST_ENTRY InLoadOrderModuleList;
    LIST_ENTRY InMemoryOrderModuleList;
    LIST_ENTRY InInitializationOrderModuleList;
    LPVOID     lpEntryInProgress;

Does anyone know its actual use or content?

1 Answer 1


I know length is sizeof(struct)

0:000> ?? sizeof(ntdll!_PEB_LDR_DATA)
unsigned int64 0x58
0:000> dt -r nt!_peb Ldr->Length @$peb
   +0x018 Ldr         :
      +0x000 Length      : 0x58


As per Geoff Chappel there is No known Usage of SSHandle
so just leave it as PVOID

  • I will leave it as a mystery. Thanks!
    – Luloppers
    Dec 8, 2021 at 15:27
  • if you found the answer was sufficient enough for the purpose mark it as such so that it doesnt popup in unanswered queue
    – blabb
    Dec 8, 2021 at 15:59
  • 1
    SsHandle certainly sounds like "subsystem handle" ... so given the (ex-Win32, now) Windows subsystem (csrss) is the only proper subsystem left in modern NT versions (WSL isn't such a subsystem), there's a chance that this played a role when NT still had a POSIX and OS/2 "personality", too ... but just guessing. At least registration with csrss is one of the big items during Win32 UM process initialization.
    – 0xC0000022L
    Dec 15, 2021 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.