// 枚举进程模块,不过如果你想枚举其他进程的模块可以使用
// OpenProcess、EnumProcessModules
// ZwQueryVirtualMemory 百度一大把VC+案例
// 不过需要提升应用权限,RtlAdjustPrivilege(20, 1, 0, 0)
/*
方法详解:
创建进程快照
到模块首部
判断循环检查 NOT NULL Type BOOL
剩下你懂的
这个类似于
遍历目录文件
*/
namespace eMod
{
using System;
using IO = System.IO;
using System.Collections.Generic;
using System.Text;
using System.Diagnostics;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential)]
public struct Module
{
[DllImportAttribute("kernel32.dll")]
static extern int FreeLibrary(int hLibModule);
[DllImportAttribute("kernel32.dll")]
static extern void FreeLibraryAndExitThread(int hLibModule, uint dwExitCode);
public string Name;
public string Path;
public string Type;
public int hModule;
public string Description;
public bool FreeModule()
{
return FreeLibrary(this.hModule) != 0;
}
public void FreeModuleAndThread(uint dwExitCode)
{
FreeLibraryAndExitThread(this.hModule, dwExitCode);
}
}
public partial class Process
{
[StructLayout(LayoutKind.Sequential)]
struct LPMODULEENTRY32
{
public int size;
public int mid;