The incident reporting service now calls VerifyModule.

chrome/common/safe_browsing/csd.proto

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Client side phishing and malware detection request and response
 // protocol buffers.  Those protocol messages should be kept in sync
 // with the server implementation.
 //
 // If you want to change this protocol definition or you have questions
 // regarding its format please contact chrome-anti-phishing@googlegroups.com.
@@ skipping 393 matching lines @@
           UNKNOWN = 0;
           LSP = 1;
         }
         optional string path = 1;
         optional uint64 base_address = 2;
         optional uint32 length = 3;
         repeated Feature feature = 4;
       }
       repeated Dll dll = 9;
       repeated string blacklisted_dll = 10;
+      message ModuleState {
+        enum ModifiedState {
+          UNKNOWN = 0;
+          MODULE_STATE_UNKNOWN = 1;
+          MODULE_STATE_UNMODIFIED = 2;
+          MODULE_STATE_MODIFIED = 3;
+        }
+        optional string name = 1;
+        optional ModifiedState modified_state = 2;
+        repeated string modified_export = 3;
+      }
+      repeated ModuleState module_state = 11;
     }
     optional Process process = 3;
   }
 
   optional EnvironmentData environment = 3;
 }
 
 message ClientIncidentResponse {
   optional bytes token = 1;
   optional bool download_requested = 2;
 
   message EnvironmentRequest { optional int32 dll_index = 1; }
 
   repeated EnvironmentRequest environment_requests = 3;
 }