MCPcopy Create free account
hub / github.com/rabbitstack/fibratus / getModuleBaseAddress

Function getModuleBaseAddress

pkg/pe/parser_test.go:151–163  ·  view source on GitHub ↗
(pid uint32)

Source from the content-addressed store, hash-verified

149}
150
151func getModuleBaseAddress(pid uint32) (uintptr, error) {
152 var moduleHandles [1024]windows.Handle
153 var cbNeeded uint32
154 proc, err := windows.OpenProcess(windows.PROCESS_QUERY_INFORMATION|windows.PROCESS_VM_READ, false, pid)
155 if err != nil {
156 return 0, err
157 }
158 if err := windows.EnumProcessModulesEx(proc, &moduleHandles[0], 1024, &cbNeeded, windows.LIST_MODULES_ALL); err != nil {
159 return 0, err
160 }
161 moduleHandle := moduleHandles[0]
162 return uintptr(moduleHandle), nil
163}

Callers 2

TestIsHeaderModifiedFunction · 0.70
TestParseMemFunction · 0.70

Calls

no outgoing calls

Tested by

no test coverage detected