Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- void remote_listmodules(HANDLE proc, void *_peb)
- {
- PEB peb;
- PEB_LDR_DATA LdrData;
- DWORD bytesRead = 0;
- void *flink;
- void *cmod;
- void *_BaseAddress = 0;
- void *_BaseDllName = 0;
- if (_peb == NULL) return;
- // Get remote PEB information
- memset((void *)&peb, 0, sizeof(PEB));
- ReadProcessMemory(proc, (LPVOID)_peb, &peb, sizeof(PEB), &bytesRead);
- // Get LdrData
- memset((void *)&LdrData, 0, sizeof(PEB_LDR_DATA));
- ReadProcessMemory(proc, (LPVOID)peb->LoaderData, &LdrData, sizeof(PEB_LDR_DATA), &bytesRead);
- // Get first link
- flink = LdrData.InLoadOrderModuleList.Flink;
- cmod = flink;
- do
- {
- // Get module base address:
- ReadProcessMemory(proc, (LPVOID)((DWORD)cmod+0x10), &_BaseAddress, sizeof(DWORD), &bytesRead);
- // I'll leave getting the module name as an exercise for the capt. micro!
- if (_BaseAddress != 0)
- wprintf(L"%s @ 0x%X\n", (WCHAR*)_BaseDllName, (ULONG)_BaseAddress);
- // Get pointer to next item
- ReadProcessMemory(proc, (LPVOID)cmod, &cmod, sizeof(LPVOID), &bytesRead);
- } while (cmod != NULL && cmod != flink);
- return;
- }
Add Comment
Please, Sign In to add comment