Method FillModuleList

Process/Process.cpp:493–539

FillModuleList - fills the `ModuleList` class member with a list of module information returns true on success */

    returns true on success
*/
bool Process::FillModuleList()
{
    HMODULE hModules[512];
    DWORD cbNeeded = 0;

    if (EnumProcessModules(GetCurrentProcess(), hModules, sizeof(hModules), &cbNeeded))
    {
        Logger::logf(Err, "EnumProcessModules failed @ Process::FillModuleList");
        return false;
    }

    if (this->ModuleList.size() >= (cbNeeded / sizeof(HMODULE))) //already filled previously?
        return false;

    for (unsigned int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) 
    {
        ProcessData::MODULE_DATA module;
            
        TCHAR szModuleName[MAX_PATH];
        MODULEINFO moduleInfo;

        if (!GetModuleFileNameEx(GetCurrentProcess(), hModules[i], szModuleName, sizeof(szModuleName) / sizeof(TCHAR)))
        {
            Logger::logf(Warning, "GetModuleFileNameEx failed @ Process::FillModuleList: Error %d", GetLastError());
            continue;
        }

        module.name = wstring(szModuleName);

        module.hModule = hModules[i];

        if (GetModuleInformation(GetCurrentProcess(), hModules[i], &moduleInfo, sizeof(moduleInfo)))
        {
            module.dllInfo.lpBaseOfDll = moduleInfo.lpBaseOfDll;
            module.dllInfo.SizeOfImage = moduleInfo.SizeOfImage;
        }
        else
        {
            Logger::logf(Err, "Unable to parse module information @ Process::FillModuleList");
            return false;
        }

        this->ModuleList.push_back(module);
    }

    return true;
}

/*
    ModifyTLSCallbackPtr - changes the program TLS callback at runtime by modifying the data directory ptr (IMAGE_DIRECTORY_ENTRY_TLS)