/// <summary> /// Get the modules that have been loaded by the associated process. /// This will get an x86 process' modules when running from x64 code, /// unlike Process.Modules. /// </summary> static ProcessModuleEx[] GetProcessModules(Process p) { if (p.HasExited) { throw new ArgumentException("Process should be alive."); } if (!Environment.Is64BitProcess) { return(ModuleToModuleEx(p)); } var ret = new List <ProcessModuleEx>(); IntPtr[] hMods = new IntPtr[1024]; uint uiSize = (uint)(IntPtr.Size * hMods.Length); uint cbNeeded; try { const int LIST_MODULES_ALL = 3; if (!SafeNativeMethods.EnumProcessModulesEx(p.Handle, hMods, uiSize, out cbNeeded, LIST_MODULES_ALL)) { throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error()); } } catch (EntryPointNotFoundException) // this function is only on vista and higher. this is likely only to happen on XP x64 { return(ModuleToModuleEx(p)); // fall back } uint count = (uint)(cbNeeded / IntPtr.Size); for (int i = 0; i < count; i++) { var info = new SafeNativeMethods.MODULEINFO(); var path = new StringBuilder(260); var module = new ProcessModuleEx(); if (SafeNativeMethods.GetModuleFileNameEx(p.Handle, hMods[i], path, path.Capacity) > 0) { module.FileName = path.ToString(); module.ModuleName = Path.GetFileName(module.FileName); } if (SafeNativeMethods.GetModuleInformation(p.Handle, hMods[i], out info, (uint)Marshal.SizeOf(info))) { module.BaseAddress = info.lpBaseOfDll; module.EntryPointAddress = info.EntryPoint; module.ModuleMemorySize = (int)info.SizeOfImage; ret.Add(module); } } return(ret.ToArray()); }
/// <summary> /// Get the modules that have been loaded by the associated process. /// This will get an x86 process' modules when running from x64 code, /// unlike Process.Modules. /// </summary> static ProcessModuleEx[] GetProcessModules(Process p) { if (p.HasExited) throw new ArgumentException("Process should be alive."); if (!Environment.Is64BitProcess) return ModuleToModuleEx(p); var ret = new List<ProcessModuleEx>(); IntPtr[] hMods = new IntPtr[1024]; uint uiSize = (uint)(IntPtr.Size * hMods.Length); uint cbNeeded; try { const int LIST_MODULES_ALL = 3; if (!SafeNativeMethods.EnumProcessModulesEx(p.Handle, hMods, uiSize, out cbNeeded, LIST_MODULES_ALL)) throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error()); } catch (EntryPointNotFoundException) // this function is only on vista and higher. this is likely only to happen on XP x64 { return ModuleToModuleEx(p); // fall back } uint count = (uint)(cbNeeded / IntPtr.Size); for (int i = 0; i < count; i++) { var info = new SafeNativeMethods.MODULEINFO(); var path = new StringBuilder(260); var module = new ProcessModuleEx(); if (SafeNativeMethods.GetModuleFileNameEx(p.Handle, hMods[i], path, path.Capacity) > 0) { module.FileName = path.ToString(); module.ModuleName = Path.GetFileName(module.FileName); } if (SafeNativeMethods.GetModuleInformation(p.Handle, hMods[i], out info, (uint)Marshal.SizeOf(info))) { module.BaseAddress = info.lpBaseOfDll; module.EntryPointAddress = info.EntryPoint; module.ModuleMemorySize = (int)info.SizeOfImage; ret.Add(module); } } return ret.ToArray(); }