How to find status and path of the specific module with C in the windows?
such as windbg lm (list loaded module)
kd> lm m cdd start end module name 93ae0000 93afe000 cdd (deferred)
I need start of module(.sys) but on C code
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
VirtualQueryEx() is the way to go if you want a memory map of a target process.
However, if you want information about modules only, you can extract it from the PEB of the target process.
Get the PEB address using
ProcessBasicInformation for the
ProcessInformationClass, so it writes a
PROCESS_BASIC_INFORMATION. This structure has a
PebBaseAddress field that gives you the PEB address.
Here is a demonstration of that technique.
modules.exe : 0x00400000 -> 0x00422fff (C:\Users\Spl3en\Desktop\modules.exe) ntdll.dll : 0x81d20000 -> 0x81ec8fff (C:\Windows\SYSTEM32\ntdll.dll) KERNEL32.DLL : 0x7f660000 -> 0x7f798fff (C:\Windows\system32\KERNEL32.DLL) KERNELBASE.dll : 0x7f450000 -> 0x7f55dfff (C:\Windows\system32\KERNELBASE.dll) msvcrt.dll : 0x7f970000 -> 0x7fa16fff (C:\Windows\system32\msvcrt.dll)