Modules loaded by a exe

hi,
I would like to know how some programs such as LordPE displays dll loaded by an executable, what API are called? thanks in advance

[Shub-Nigurrath]

look here, it's extremely simple

hxxp://www.codeguru.com/Cpp/W-P/system/processesmodules/article.php/c5729/

and also here

hxxp://www.codeguru.com/Cpp/W-P/system/processesmodules/article.php/c2873/

thanks for the info man!

Sorry, but the method above is suxx. Too easy to fool. If you want to create sth really useful, you stick to NT+ architecture. Go search for "PEB_LDR_DATA". This is what you need.

[Shub-Nigurrath]

humm..that undocumented things are supported through different OSs (XP,2003)?
It depends on which level you want to be sure of this..the infos obtained are almost the same, isn't it?

PEB is present starting from NT+.
The exact implementation of the structure is different. You can extract it from PDB-files using pdb-dump by de Quency.

Originally Posted by loman

hi,
I would like to know how some programs such as LordPE displays dll loaded by an executable, what API are called? thanks in advance

#include <tlhelp32.h> 

  DWORD currentProcessId = ::GetCurrentProcessId();
  HANDLE h = ::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, currentProcessId); 
  if (h != INVALID_HANDLE_VALUE) 
  {
    MODULEENTRY32 me32 = {0}; 
    me32.dwSize = sizeof MODULEENTRY32; 

    for (BOOL b = ::Module32First(h, &me32); b; b = ::Module32Next(h, &me32))
    { 
       // do something with me32
    }
    ::CloseHandle(h); 
  }

Lord PE is outdated. I personally, respect Yoda, but his really good piece of software has not been updated for many-many years. Thus, the method above is suxx. Use RtlQueryProcessDebugInformation instead.
Sth like:


QUERYDEBUGBUFFER *pModuleInfo; // modules information
DWORD dwNtStatus; // return code
// RtlQueryProcessDebugInformation
DWORD dwPID; // process PID
// get the memory for the buffer
DWORD *pRtlBuffer = RtlCreateQueryDebugBuffer(NULL, NULL);

if(!pRtlBuffer)
{
// Error!
}
// get the info about the modules
dwNtStatus = RtlQueryProcessDebugInformation((HANDLE *)dwPID, 0x01, pRtlBuffer);

if(!dwNtStatus)
{
pModuleInfo = (QUERYDEBUGBUFFER*)pRtlBuffer;

// enumerate the modules
for(int i = 0; i < pModuleInfo->dwNumNames; i++)
{
printf(��ImageBase: 0x%0.8Xl��, pModuleInfo[i]->ImageBase);
printf(��ImageSize: 0x%0.8Xl��, pModuleInfo[i]->ImageSize);
...
}
}
else if(dwNtStatus == DEBUG_ACCESS_DENIED)
{
// Error
}

// free the buffer
RtlDestroyQueryDebugBuffer(pModuleInfo);


Actually, we wrote much more information in
http://wasm.ru/article.php?article=packers2
but one has to know Russian to be able to understand sth...