Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   Modules loaded by a exe (https://forum.exetools.com/showthread.php?t=4267)

volodya 05-18-2004 22:37

Lord PE is outdated. I personally, respect Yoda, but his really good piece of software has not been updated for many-many years. Thus, the method above is suxx. Use RtlQueryProcessDebugInformation instead.
Sth like:


QUERYDEBUGBUFFER *pModuleInfo; // modules information
DWORD dwNtStatus; // return code
// RtlQueryProcessDebugInformation
DWORD dwPID; // process PID
// get the memory for the buffer
DWORD *pRtlBuffer = RtlCreateQueryDebugBuffer(NULL, NULL);

if(!pRtlBuffer)
{
// Error!
}
// get the info about the modules
dwNtStatus = RtlQueryProcessDebugInformation((HANDLE *)dwPID, 0x01, pRtlBuffer);

if(!dwNtStatus)
{
pModuleInfo = (QUERYDEBUGBUFFER*)pRtlBuffer;

// enumerate the modules
for(int i = 0; i < pModuleInfo->dwNumNames; i++)
{
printf(��ImageBase: 0x%0.8Xl��, pModuleInfo[i]->ImageBase);
printf(��ImageSize: 0x%0.8Xl��, pModuleInfo[i]->ImageSize);
...
}
}
else if(dwNtStatus == DEBUG_ACCESS_DENIED)
{
// Error
}

// free the buffer
RtlDestroyQueryDebugBuffer(pModuleInfo);


Actually, we wrote much more information in
http://wasm.ru/article.php?article=packers2
but one has to know Russian to be able to understand sth...


All times are GMT +8. The time now is 00:25.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX