枚举进程模块的各种方法[冲浪网络论坛]

  一：进程快照
  HANDLE hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());
  if (hModuleSnap == INVALID_HANDLE_VALUE)
  {
   return FALSE;
  }
  MODULEENTRY32 me32={0};
  me32.dwSize = sizeof(MODULEENTRY32);
  BOOL bOK = Module32First(hModuleSnap, &me32);
  if (bOK)
  {
   do
   {
    //me32为模块详细信息
   } while (Module32Next(hModuleSnap, &me32));
  }
  CloseHandle(hModuleSnap);

  二：PSAPI方法
  HANDLE hProcess = GetCurrentProcess();
  HMODULE hMods[1024]={0};
  DWORD cbNeeded = 0;
  bOK = EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded);
  if(bOK)
  {
   size_t count = cbNeeded / sizeof(HMODULE);
   for ( size_t i = 0; i < count ; i++ )
   {
    char szModName[MAX_PATH]={0};
    GetModuleFileNameEx( hProcess, hMods[i], szModName,sizeof(szModName));
    if(check_path(szModName))
    {
     ;//hMod为PDWORD 模块句柄，szModName为模块路径
    }
   }
  }

三：查找内存方法

   DWORD dwStartAddr = 0x00000000;
   BYTE szBuffer[MAX_PATH * 2 + 4] = {0};
   WCHAR szModuleName[MAX_PATH] = {0};
   WCHAR szPathName[MAX_PATH] = {0};
   MEMORY_BASIC_INFORMATION mbi;
   PUNICODE_STRING usSectionName;
   ZWQUERYVIRTUALMEMORY fnZwQueryVirtualMemory;
   HANDLE hProcess =NULL;
   hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, dwProcessId);
   if (hProcess == NULL)
   {
     return FALSE;
   }


   dwStartAddr = 0x00000000;
   fnZwQueryVirtualMemory = (ZWQUERYVIRTUALMEMORY)::GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryVirtualMemory" );
   if(fnZwQueryVirtualMemory)
   {
     do
     {
      if (fnZwQueryVirtualMemory(hProcess,(PVOID)dwStartAddr,MemoryBasicInformation,&mbi,sizeof(mbi),0) >= 0 )
      {
       if(mbi.Type == MEM_IMAGE)
       {
        if (fnZwQueryVirtualMemory( hProcess,(PVOID)dwStartAddr,MemorySectionName,szBuffer,sizeof(szBuffer),0) >= 0 )
        {
         usSectionName = (PUNICODE_STRING)szBuffer;
         if( _wcsnicmp(szModuleName, usSectionName->Buffer, usSectionName->Length / sizeof(WCHAR)) )
         {
          wcsncpy_s(szModuleName, usSectionName->Buffer, usSectionName->Length / sizeof(WCHAR) );
          szModuleName[usSectionName->Length / sizeof(WCHAR)] = UNICODE_NULL;

          USES_CONVERSION;
          CHAR *pTemp=W2A(szPathName);
          //pTemp 为模块路径
         }
        }
       }
      }

      dwStartAddr += 0x1000;
     }while( dwStartAddr < 0x80000000 );
   }
   CloseHandle(hProcess);

主题：枚举进程模块的各种方法