Joined: 25 Jan 2006 Posts: 8579 Location: 127.0.0.1
Posted: Wed Aug 31, 2022 1:59 pm Post subject:
You can query the processes modules multiple different ways. C# includes a 'Process' class within the System.Diagnostics namespace which can query for a process, then within that you can check the 'Modules' property of a given process.
You can also manually iterate them through API calls such as:
via tlhelp32 (exposed via kernel32.dll):
- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next
via psapi (exposed via psapi.dll):
- EnumProcesses
- EnumProcessModules / EnumProcessModulesEx
- GetModuleInformation
To get the list of exported functions from a DLL, you can either walk to EAT (export address table) of the PE header yourself, or you can use the debug helper library (dbghelp.dll) and enumerate them. For that you would need calls like:
- SymInitialize / SymCleanup
- SymLoadModuleEx
- SymEnumerateSymbols64
- SymEnumerateSymbolsProc64
You can find tons of examples of doing it manually by manually walking/reading the PE header and such across the web. _________________
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum