What is signed is a simplified version of the transaction (replacing the scriptSig, since that is what we are creating). There is a lot here so hopefully I covered it all:
* `version` (4 Bytes) - Transaction format version
* `flag` (2 Byte Array) - Optional flag, if present, must be 0001, which indicates there is witness data in this transaction
* `input counter` (Variable Length) - Number of inputs in the transaction represented by a Variable Length Integer.
* `inputs` (based on Input Counter) - List of all transaction inputs which will be spent and which reference unspent transaction outputs from previous transactions.
* `output counter` (Variable Length) - Number of outputs in the transaction represented by a Variable Length Integer.
* `outputs` (based on Output Counter) - List of all transaction outputs where the coins will be sent and which will become unspent transaction outputs to be spent in future transactions.
* `scriptsig` (variable) - First, a one-byte varint which denotes the length of the scriptSig, then it is temporarily filled with the scriptPubKey of the output we want to redeem.
* sequence number (4 Bytes) - Used as a relative lock time if transaction version is >= 2. See BIP68.
* one-byte varint containing the number of outputs in our new transaction
* 8-byte field (64 bit integer) containing the amount we want to redeem from the specified output (in satoshis)
* one-byte varint denoting the length of the output script
* output script
* `locktime` (4 Bytes) - If non-zero and sequence numbers are < `ffffffff`: it represents either the block height or timestamp when transaction is final.
* four-byte "hash code type" (1 in our case): 01000000 see [Sighash types][1]
Then, double-SHA256 hash this entire structure and the hash is what is signed. For an example, see https://bitcoin.stackexchange.com/a/5241/60443