MCPcopy Create free account
hub / github.com/aardappel/treesheets / GetModuleListTH32

Method GetModuleListTH32

src/StackWalker/StackWalker.cpp:549–608  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

547 #pragma pack( pop )
548
549 BOOL GetModuleListTH32(HANDLE hProcess, DWORD pid)
550 {
551 // CreateToolhelp32Snapshot()
552 typedef HANDLE (__stdcall *tCT32S)(DWORD dwFlags, DWORD th32ProcessID);
553 // Module32First()
554 typedef BOOL (__stdcall *tM32F)(HANDLE hSnapshot, LPMODULEENTRY32 lpme);
555 // Module32Next()
556 typedef BOOL (__stdcall *tM32N)(HANDLE hSnapshot, LPMODULEENTRY32 lpme);
557
558 // try both dlls...
559 const TCHAR *dllname[] = { _T("kernel32.dll"), _T("tlhelp32.dll") };
560 HINSTANCE hToolhelp = NULL;
561 tCT32S pCT32S = NULL;
562 tM32F pM32F = NULL;
563 tM32N pM32N = NULL;
564
565 HANDLE hSnap;
566 MODULEENTRY32 me;
567 me.dwSize = sizeof(me);
568 BOOL keepGoing;
569 size_t i;
570
571 for (i = 0; i<(sizeof(dllname) / sizeof(dllname[0])); i++ )
572 {
573 hToolhelp = LoadLibrary( dllname[i] );
574 if (hToolhelp == NULL)
575 continue;
576 pCT32S = (tCT32S) GetProcAddress(hToolhelp, "CreateToolhelp32Snapshot");
577 pM32F = (tM32F) GetProcAddress(hToolhelp, "Module32First");
578 pM32N = (tM32N) GetProcAddress(hToolhelp, "Module32Next");
579 if ( (pCT32S != NULL) && (pM32F != NULL) && (pM32N != NULL) )
580 break; // found the functions!
581 FreeLibrary(hToolhelp);
582 hToolhelp = NULL;
583 }
584
585 if (hToolhelp == NULL)
586 return FALSE;
587
588 hSnap = pCT32S( TH32CS_SNAPMODULE, pid );
589 if (hSnap == (HANDLE) -1)
590 {
591 FreeLibrary(hToolhelp);
592 return FALSE;
593 }
594
595 keepGoing = !!pM32F( hSnap, &me );
596 int cnt = 0;
597 while (keepGoing)
598 {
599 this->LoadModule(hProcess, me.szExePath, me.szModule, (DWORD64) me.modBaseAddr, me.modBaseSize);
600 cnt++;
601 keepGoing = !!pM32N( hSnap, &me );
602 }
603 CloseHandle(hSnap);
604 FreeLibrary(hToolhelp);
605 if (cnt <= 0)
606 return FALSE;

Callers

nothing calls this directly

Calls 1

LoadModuleMethod · 0.95

Tested by

no test coverage detected