Function ProcessEnumerateModules

RedEdrShared/process_query.cpp:200–292

Enumerate all modules loaded in the process (DLL's), and their sections

// Enumerate all modules loaded in the process (DLL's), and their sections
std::vector<ProcessLoadedDll> ProcessEnumerateModules(HANDLE hProcess) {
    std::vector<ProcessLoadedDll> processLoadedDlls;
    
    if (!hProcess || hProcess == INVALID_HANDLE_VALUE) {
        LOG_A(LOG_ERROR, "ProcessEnumerateModules: Invalid process handle");
        return processLoadedDlls;
    }

    PROCESS_BASIC_INFORMATION pbi = {};
    ULONG returnLength;

    // PBI
    NTSTATUS status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), &returnLength);
    if (status != 0) {
        LOG_A(LOG_ERROR, "ProcessEnumerateModules: Error: Could not NtQueryInformationProcess for %lu, error: %lu", 
            static_cast<unsigned long>(status), GetLastError());
        return processLoadedDlls;
    }

    // PEB
    MYPEB peb = {};
    if (!ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), NULL)) {
        LOG_A(LOG_WARNING, "ProcessEnumerateModules: Error: Could not ReadProcessMemory1 error: %lu",
            GetLastError());
        return processLoadedDlls;
    }

    if (!peb.Ldr) {
        LOG_A(LOG_WARNING, "ProcessEnumerateModules: PEB.Ldr is NULL");
        return processLoadedDlls;
    }

    // PEB_LDR_DATA
    PEB_LDR_DATA ldr = {};
    if (!ReadProcessMemory(hProcess, peb.Ldr, &ldr, sizeof(PEB_LDR_DATA), NULL)) {
        LOG_A(LOG_WARNING, "ProcessEnumerateModules: ReadProcessMemory failed for PEB_LDR_DATA. Error: %lu", GetLastError());
        return processLoadedDlls;
    }

    // InMemoryOrderModuleList
    LIST_ENTRY* head = &ldr.InMemoryOrderModuleList;
    LIST_ENTRY* current = ldr.InMemoryOrderModuleList.Flink;
    
    // Prevent infinite loop by limiting iterations
    int maxIterations = 1000;
    int iteration = 0;
    
    while (current != head && iteration < maxIterations) {
        ProcessLoadedDll processLoadedDll = {};

        _LDR_DATA_TABLE_ENTRY entry = {};
        if (!ReadProcessMemory(hProcess, CONTAINING_RECORD(current, _LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks),
            &entry, sizeof(_LDR_DATA_TABLE_ENTRY), NULL))
        {
            LOG_A(LOG_WARNING, "ProcessEnumerateModules: ReadProcessMemory failed for LDR_DATA_TABLE_ENTRY. Error: %lu", GetLastError());
            break;
        }