Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- bool enumerate_modules()
- {
- union {
- PVOID buf;
- PUNICODE_STRING section_name;
- };
- enum { buf_size = MAXUSHORT + sizeof(UNICODE_STRING) };
- if (!(buf = LocalAlloc(0, buf_size)))
- {
- return false;
- }
- SYSTEM_INFO si;
- GetSystemInfo(&si);
- while (si.lpMinimumApplicationAddress < si.lpMaximumApplicationAddress)
- {
- MEMORY_BASIC_INFORMATION mbi;
- NTSTATUS status = NtQueryVirtualMemory(NtCurrentProcess(), si.lpMinimumApplicationAddress,
- MemoryBasicInformation, &mbi, sizeof mbi, 0);
- if (!NT_SUCCESS(status))
- break;
- if (mbi.State == MEM_COMMIT && mbi.Type == MEM_IMAGE && mbi.AllocationBase == mbi.BaseAddress)
- {
- status = NtQueryVirtualMemory(NtCurrentProcess(), si.lpMinimumApplicationAddress,
- MemoryMappedFilenameInformation, section_name, buf_size, nullptr);
- if (NT_SUCCESS(status))
- {
- DbgPrint("%p %wZ\n", si.lpMinimumApplicationAddress, section_name);
- }
- }
- si.lpMinimumApplicationAddress = (PBYTE)mbi.BaseAddress + mbi.RegionSize;
- }
- LocalFree(buf);
- return true;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement