Method GetModuleInfo

Process/Process.cpp:779–825

GetModuleInfo - returns a ProcessData::MODULE_DATA* representing the module given `name`. returns nullptr on failure/no module found */

    returns nullptr on failure/no module found
*/
ProcessData::MODULE_DATA Process::GetModuleInfo(__in const  wchar_t* name)
{
    if (name == nullptr)
    {
        Logger::logf(Err, "name was nullptr @ Process::GetModuleInfo");
        return {};
    }

#ifdef _M_IX86
    MYPEB* peb = (MYPEB*)__readfsdword(0x30);
#else
    MYPEB* peb = (MYPEB*)__readgsqword(0x60);
#endif

    uintptr_t kernel32Base = 0;

    LIST_ENTRY* current_record = NULL;
    LIST_ENTRY* start = &(peb->Ldr->InLoadOrderModuleList);

    current_record = start->Flink;

    while (true)
    {
        MY_LDR_DATA_TABLE_ENTRY* module_entry = (MY_LDR_DATA_TABLE_ENTRY*)CONTAINING_RECORD(current_record, MY_LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);

        if (wcscmp(module_entry->BaseDllName.Buffer, name) == 0)
        {
            ProcessData::MODULE_DATA module;

            module.name = wstring(module_entry->FullDllName.Buffer);
            module.baseName =  wstring(module_entry->BaseDllName.Buffer);
            module.hModule = (HMODULE)module_entry->DllBase;
            module.dllInfo.lpBaseOfDll = module_entry->DllBase;
            module.dllInfo.SizeOfImage = module_entry->SizeOfImage;
            return module;
        }

        current_record = current_record->Flink;

        if (current_record == start)
        {
            break;
        }
    }

    return {};
}

/*
    GetModuleHandle_Ldr - returns base address of a module as HMODULE type