[ahmadmansoor]

Thanks D-Jester and Fyyre ...
but what i mean that I have the address memory , and I want to know which API related to this address memory .
that what I mean .
@ Fyyre : thanks for nice code ... easy and can be useful .
in ur code it need this too

PVOID NTAPI RtlImageDirectoryEntryToData ( PVOID BaseAddress,
BOOLEAN MappedAsImage,
USHORT Directory,
PULONG Size
) ;