开发者

How to enumerate a process's modules?

My application creates a suspended process, gets process's information via VirtualQueryEx() ,but fails getting process's module information using EnumProcessModules().

The task above is completed ONLY if the process is NOT created suspended and a breakpoint is hit in the debugger(s开发者_JAVA百科o the program runs, before the call is executed).

I'm trying to write a very decent disassembler and for that I would need to run a target process suspended, but EnumProcessModules() does not work on suspended processes.

Is there an alternative?


I dealt with something like this several years ago. If I remember right, what I ended up doing was creating the task suspended, then GetThreadContext, set its trap flag, SetThreadContext, resume the thread (which runs one instruction), then use EnumProcessModules.

Of course, there may be other ways to handle this, but at least if memory serves, that's what I came up with at the time and I seem to recall its working.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜