Should use _KLDR_DATA_TABLE_ENTRY for kernel modules for Windows 10+

[gleeda]

Just a note, so we don't lose this. Example:

In [1]: k = obj.Object("_KLDR_DATA_TABLE_ENTRY", offset=0xFFFFA0878DC37010, vm=addrspace())

In [2]: dt(k)
[CType _KLDR_DATA_TABLE_ENTRY] @ 0xFFFFA0878DC37010
0x0   : InLoadOrderLinks               18446639102792265744
0x10  : ExceptionTable                 18446735287116500992
0x18  : ExceptionTableSize             325764
0x20  : GpValue                        0
0x28  : NonPagedDebugInfo              0
0x30  : DllBase                        18446735287113007104
0x38  : EntryPoint                     18446735287116959760
0x40  : SizeOfImage                    8519680
0x48  : FullDllName                    \SystemRoot\system32\ntoskrnl.exe
0x58  : BaseDllName                    ntoskrnl.exe
0x68  : Flags                          142622720
0x6c  : LoadCount                      90
0x6e  : u1                             18446639102792265854
0x70  : SectionPointer                 0
0x78  : CheckSum                       7842901
0x7c  : CoverageSectionSize            0
0x80  : CoverageSection                0
0x88  : LoadedImports                  1
0x90  : Spare                          0
0x98  : SizeOfImageNotRounded          8519680
0x9c  : TimeDateStamp                  2016-07-16 02:16:17 UTC+0000

You can see that this looks better than:

In [6]: m = obj.Object("_LDR_DATA_TABLE_ENTRY", offset=0xFFFFA0878DC37010, vm=addrspace())

In [7]: dt(m)
[_LDR_DATA_TABLE_ENTRY _LDR_DATA_TABLE_ENTRY] @ 0xFFFFA0878DC37010
0x0   : InLoadOrderLinks               18446639102792265744
0x10  : InMemoryOrderLinks             18446639102792265760
0x20  : InInitializationOrderLinks     18446639102792265776
0x30  : DllBase                        18446735287113007104
0x38  : EntryPoint                     18446735287116959760
0x40  : SizeOfImage                    8519680
0x48  : FullDllName                    \SystemRoot\system32\ntoskrnl.exe
0x58  : BaseDllName                    ntoskrnl.exe
[snip]
0xf8  : OriginalBase                   2080
0x100 : LoadTime                       1970-01-01 00:00:00 UTC+0000  # <--- ???
[snip]