static Process[] GetProcessesByPath(string path) { List <Process> result = new List <Process>(); string processName = Path.GetFileNameWithoutExtension(path); foreach (var process in Process.GetProcessesByName(processName)) { ToolHelpHandle hModuleSnap = NativeMethods.CreateToolhelp32Snapshot(NativeMethods.SnapshotFlags.Module, (uint)process.Id); if (!hModuleSnap.IsInvalid) { NativeMethods.MODULEENTRY32 me32 = new NativeMethods.MODULEENTRY32(); me32.dwSize = (uint)System.Runtime.InteropServices.Marshal.SizeOf(me32); if (NativeMethods.Module32First(hModuleSnap, ref me32)) { if (me32.szExePath == path) { result.Add(process); } } hModuleSnap.Close(); } } return(result.ToArray()); }
public static IEnumerable <NativeMethods.MODULEENTRY32> GetModulesByProcessId(int processId) { var me32 = new NativeMethods.MODULEENTRY32(); var hModuleSnap = NativeMethods.CreateToolhelp32Snapshot( NativeMethods.SnapshotFlags.Module | NativeMethods.SnapshotFlags.Module32, processId); if (!hModuleSnap.IsInvalid) { using (hModuleSnap) { me32.dwSize = (uint)Marshal.SizeOf(me32); if (NativeMethods.Module32First(hModuleSnap, ref me32)) { do { yield return(me32); } while (NativeMethods.Module32Next(hModuleSnap, ref me32)); } } } }
private void LoadModules() { _modules = new List <NativeMethods.MODULEENTRY32>(); NativeMethods.GetWindowThreadProcessId(Hwnd, out int processId); var hModuleSnap = NativeMethods.CreateToolhelp32Snapshot(NativeMethods.SnapshotFlags.Module | NativeMethods.SnapshotFlags.Module32, processId); if (!hModuleSnap.IsInvalid) { using (hModuleSnap) { var me32 = new NativeMethods.MODULEENTRY32(); me32.dwSize = (uint)Marshal.SizeOf(me32); if (NativeMethods.Module32First(hModuleSnap, ref me32)) { do { _modules.Add(me32); } while (NativeMethods.Module32Next(hModuleSnap, ref me32)); } } } }
/// <summary> /// Retrieves the names of all loaded modules in the process, their base /// address and size on disk. /// </summary> /// /// <param name="pid"> /// Id of the process. /// </param> private void GetModuleDetails(int pid) { const NativeMethods.SnapshotFlags flags = NativeMethods.SnapshotFlags.TH32CS_SNAPMODULE | NativeMethods.SnapshotFlags.TH32CS_SNAPMODULE32; var hModuleSnap = NativeMethods.CreateToolhelp32Snapshot(flags, pid); if (hModuleSnap == INVALID_HANDLE_VALUE) { return; } var modEntry = new NativeMethods.MODULEENTRY32() { dwSize = (uint)Marshal.SizeOf(typeof(NativeMethods.MODULEENTRY32)), th32ModuleID = 0 }; if (!NativeMethods.Module32First(hModuleSnap, ref modEntry)) { NativeMethods.CloseHandle(hModuleSnap); return; } do { try { var modPath = modEntry.szExePath; var modInfo = FileVersionInfo.GetVersionInfo(modPath); var modSize = new FileInfo(modPath).Length; var lvi = new ListViewItem(modEntry.szModule) { Tag = modInfo.FileName, ToolTipText = modInfo.FileName + "\n" + modInfo.LegalCopyright + "\n" + modInfo.FileDescription + "\n" + modInfo.ProductVersion }; lvi.SubItems.Add("0x" + modEntry.modBaseAddr.ToString("X4")); lvi.SubItems.Add(FormatByteSize(modSize)); LV_Module.Items.Add(lvi); } catch { break; } }while (NativeMethods.Module32Next(hModuleSnap, ref modEntry)); // Close the object NativeMethods.CloseHandle(hModuleSnap); /* Sort the items and remove the duplicate module name. The ** duplication happens because SnapshotFlags searches for both 32-bit ** and 64-bit modules. Therefore, it adds the main module from both ** TH32CS_SNAPMODULE and TH32CS_SNAPMODULE32. */ LV_Module.Items[0].BackColor = SystemColors.GradientActiveCaption; LV_Module.Sorting = SortOrder.Ascending; for (var i = 0; i < LV_Module.Items.Count - 1; i++) { if (LV_Module.Items[i].Tag.Equals(LV_Module.Items[i + 1].Tag)) { LV_Module.Items[i].BackColor = SystemColors.GradientActiveCaption; LV_Module.Items[i + 1].Remove(); i--; } moduleCount = i; } SetModuleCount(); }