//thanks for powerful windbg~
BOOL FindModule(HANDLE hProcess, HMODULE hModule, PLDR_DATA_TABLE_ENTRY pLdrData)
{
DWORD i;
PLIST_ENTRY pListEntry;
PPEB_LDR_DATA pPebLdr;
PROCESS_BASIC_INFORMATION pbi;
NTSTATUS Status;
Status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL);
if(!NT_SUCCESS(Status)) {
SetLastError(RtlNtStatusToDosError(Status));
return FALSE;
}
if(hModule == NULL) {
if(!ReadProcessMemory(hProcess, &(pbi.PebBaseAddress->ImageBaseAddress), &hModule, sizeof(hModule), NULL))
return FALSE;
}
if(!ReadProcessMemory(hProcess, &(pbi.PebBaseAddress->Ldr), &pPebLdr, sizeof(pPebLdr), NULL))
return 0;
if(pPebLdr) {
if(!ReadProcessMemory(hProcess, &(pPebLdr->InMemoryOrderModuleList), &pListEntry, sizeof(pListEntry), NULL))
return FALSE;
i = 0;
while(pListEntry != &(pPebLdr->InMemoryOrderMod
还原GetModuleFileNameExW
最新推荐文章于 2017-09-13 14:10:18 发布