Advertisement
waliedassar

Enumerate All Loaded Modules

Sep 10th, 2012
301
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 1.62 KB | None | 0 0
  1. //http://waleedassar.blogspot.com - (@waleedassar)
  2. //This code shows how to list all loaded (even those hidden) modules of a process.
  3. #include "stdafx.h"
  4. #include "windows.h"
  5. #include "stdio.h"
  6.  
  7. #define MemorySectionName         0x2
  8. #define MemoryBasicVlmInformation 0x3
  9. struct UNICODE_S
  10. {
  11.     unsigned short len;
  12.     unsigned short man_len;
  13.     wchar_t* pStr;
  14. };
  15. struct MEMORY_BASIC_VLM_INFORMATION
  16. {
  17.     unsigned long ImageBase;
  18.     unsigned long blah[0x2];
  19.     unsigned long SizeOfImage;
  20. };
  21. extern "C"
  22. {
  23.     int __stdcall ZwQueryVirtualMemory(HANDLE,void*,int,void*,int,unsigned long*);
  24. }
  25. int main(int argc, char* argv[])
  26. {
  27.     SYSTEM_INFO SI={0};
  28.     GetSystemInfo(&SI);
  29.     unsigned long min_addr=(unsigned long)(SI.lpMinimumApplicationAddress);
  30.     unsigned long max_addr=(unsigned long)(SI.lpMaximumApplicationAddress);
  31.     UNICODE_S* p=(UNICODE_S*)LocalAlloc(LMEM_ZEROINIT,0x1000);  //allocate one page, to receive image file name
  32.     for(unsigned long i=min_addr;i<=max_addr;i+=(SI.dwPageSize))
  33.     {
  34.         MEMORY_BASIC_INFORMATION MBI={0};
  35.         if(VirtualQuery((void*)i,&MBI,sizeof(MBI)))
  36.         {
  37.              if(MBI.Type==MEM_IMAGE)
  38.              {
  39.                  ZwQueryVirtualMemory(GetCurrentProcess(),(void*)i,MemorySectionName,p,0x1000,0);
  40.                  wprintf(L"Module: %s\r\n",p->pStr);
  41.  
  42.                  unsigned long out=0;
  43.                  MEMORY_BASIC_VLM_INFORMATION MBVI={0};
  44.                  ZwQueryVirtualMemory(GetCurrentProcess(),(void*)i,MemoryBasicVlmInformation,&MBVI,sizeof(MBVI),&out);
  45.                  unsigned long IB=MBVI.ImageBase;
  46.                  wprintf(L"  at:%X",IB);
  47.                  unsigned long szImage=MBVI.SizeOfImage;
  48.                  wprintf(L"  size:%X\r\n",szImage);
  49.                  i+=szImage;
  50.              }
  51.         }  
  52.     }  
  53.     return 0;
  54. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement