public static uint GetRemoteModuleHandle(int processId, string moduleName)
{
IntPtr handle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, (uint)processId);
if ((int)handle > 0)
{
var list = new List <ModuleEntry32>();
var pe32 = new ModuleEntry32();
pe32.dwSize = (uint)Marshal.SizeOf(pe32);
bool bMore = Module32First(handle, ref pe32);
while (bMore)
{
IntPtr temp = Marshal.AllocHGlobal((int)pe32.dwSize);
Marshal.StructureToPtr(pe32, temp, true);
var pe = (ModuleEntry32)Marshal.PtrToStructure(temp, typeof(ModuleEntry32));
Marshal.FreeHGlobal(temp);
list.Add(pe);
bMore = Module32Next(handle, ref pe32);
}
CloseHandle(handle);
foreach (ModuleEntry32 p in list)
{
if (p.szModule.Equals(moduleName))
{
return((uint)p.modBaseAddr);
}
}
}
return(0);
}
/// <summary>
///
/// </summary>
/// <param name="hSnapshot"></param>
/// <param name="me32"></param>
/// <returns></returns>
public static bool Module32Next(IntPtr hSnapshot, ref ModuleEntry32 me32, [CallerMemberName] string callerName = "")
{
if (!PInvokeDebugger.LoggingEnabled)
{
return(PInvoke_Module32Next(hSnapshot, ref me32));
}
bool returnValue = PInvoke_Module32Next(hSnapshot, ref me32);
PInvokeDebugInfo debugInfo = PInvokeDebugInfo.TraceDebugInfo(
ModuleName,
nameof(Module32Next),
callerName,
returnValue,
false,
nameof(hSnapshot), hSnapshot,
nameof(me32), me32
);
PInvokeDebugger.SafeCapture(debugInfo);
return(returnValue);
}
public static List <ModuleEntry32> EnumProcessModules(uint procId)
{
var snapshot = CreateToolhelp32Snapshot(SnapshotFlags.Module | SnapshotFlags.Module32, procId);
var mod = new ModuleEntry32
{
dwSize = (uint)Marshal.SizeOf(typeof(ModuleEntry32))
};
if (!Module32First(snapshot, ref mod))
{
return(null);
}
List <ModuleEntry32> modules = new();
do
{
modules.Add(mod);
} while (Module32Next(snapshot, ref mod));
return(modules);
}
internal static extern bool PInvoke_Module32Next(IntPtr hSnapshot, ref ModuleEntry32 me32);
internal static extern bool Module32Next(IntPtr hSnapshot, ref ModuleEntry32 lpme);
static extern bool Module32Next(IntPtr hSnapshot, ref ModuleEntry32 lpme);
public static uint GetRemoteModuleHandle(int processId, string moduleName)
{
IntPtr handle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, (uint)processId);
if ((int)handle > 0)
{
var list = new List<ModuleEntry32>();
var pe32 = new ModuleEntry32();
pe32.dwSize = (uint)Marshal.SizeOf(pe32);
bool bMore = Module32First(handle, ref pe32);
while (bMore)
{
IntPtr temp = Marshal.AllocHGlobal((int)pe32.dwSize);
Marshal.StructureToPtr(pe32, temp, true);
var pe = (ModuleEntry32)Marshal.PtrToStructure(temp, typeof(ModuleEntry32));
Marshal.FreeHGlobal(temp);
list.Add(pe);
bMore = Module32Next(handle, ref pe32);
}
CloseHandle(handle);
foreach (ModuleEntry32 p in list)
{
if(p.szModule.Equals(moduleName))
return (uint)p.modBaseAddr;
}
}
return 0;
}
private static extern bool Module32First(IntPtr hSnapshot, ref ModuleEntry32 lpme);