| 561 | #pragma pack(pop) |
| 562 | |
| 563 | BOOL GetModuleListTH32(HANDLE hProcess, DWORD pid) |
| 564 | { |
| 565 | // CreateToolhelp32Snapshot() |
| 566 | typedef HANDLE(__stdcall * tCT32S)(DWORD dwFlags, DWORD th32ProcessID); |
| 567 | // Module32First() |
| 568 | typedef BOOL(__stdcall * tM32F)(HANDLE hSnapshot, LPMODULEENTRY32 lpme); |
| 569 | // Module32Next() |
| 570 | typedef BOOL(__stdcall * tM32N)(HANDLE hSnapshot, LPMODULEENTRY32 lpme); |
| 571 | |
| 572 | // try both dlls... |
| 573 | const TCHAR* dllname[] = {_T("kernel32.dll"), _T("tlhelp32.dll")}; |
| 574 | HINSTANCE hToolhelp = NULL; |
| 575 | tCT32S pCT32S = NULL; |
| 576 | tM32F pM32F = NULL; |
| 577 | tM32N pM32N = NULL; |
| 578 | |
| 579 | HANDLE hSnap; |
| 580 | MODULEENTRY32 me; |
| 581 | me.dwSize = sizeof(me); |
| 582 | BOOL keepGoing; |
| 583 | size_t i; |
| 584 | |
| 585 | for (i = 0; i < (sizeof(dllname) / sizeof(dllname[0])); i++) |
| 586 | { |
| 587 | hToolhelp = LoadLibrary(dllname[i]); |
| 588 | if (hToolhelp == NULL) |
| 589 | continue; |
| 590 | pCT32S = (tCT32S)GetProcAddress(hToolhelp, "CreateToolhelp32Snapshot"); |
| 591 | pM32F = (tM32F)GetProcAddress(hToolhelp, "Module32First"); |
| 592 | pM32N = (tM32N)GetProcAddress(hToolhelp, "Module32Next"); |
| 593 | if ((pCT32S != NULL) && (pM32F != NULL) && (pM32N != NULL)) |
| 594 | break; // found the functions! |
| 595 | FreeLibrary(hToolhelp); |
| 596 | hToolhelp = NULL; |
| 597 | } |
| 598 | |
| 599 | if (hToolhelp == NULL) |
| 600 | return FALSE; |
| 601 | |
| 602 | hSnap = pCT32S(TH32CS_SNAPMODULE, pid); |
| 603 | if (hSnap == (HANDLE)-1) |
| 604 | { |
| 605 | FreeLibrary(hToolhelp); |
| 606 | return FALSE; |
| 607 | } |
| 608 | |
| 609 | keepGoing = !!pM32F(hSnap, &me); |
| 610 | int cnt = 0; |
| 611 | while (keepGoing) |
| 612 | { |
| 613 | this->LoadModule(hProcess, me.szExePath, me.szModule, (DWORD64)me.modBaseAddr, |
| 614 | me.modBaseSize); |
| 615 | cnt++; |
| 616 | keepGoing = !!pM32N(hSnap, &me); |
| 617 | } |
| 618 | CloseHandle(hSnap); |
| 619 | FreeLibrary(hToolhelp); |
| 620 | if (cnt <= 0) |
nothing calls this directly
no test coverage detected