Using VirtualQueryEx to enumerate modules at remote process doesn't return all modules

Question

I am trying to get a list of DLLs that a given process is using, I am trying to achieve that through VirtualQueryEx. My problem is that it return to me just a partial list of DLLs and not all of them (i can see the list using Process Explorer or using VirtualQuery on the given process).

Here's the code:

    char szBuf[MAX_PATH * 100] = { 0 };
    PBYTE pb = NULL;
    MEMORY_BASIC_INFORMATION mbi;
    HANDLE h_process = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, iPID);


    while (VirtualQueryEx(h_process, pb, &mbi, sizeof(mbi)) == sizeof(mbi)) {

        int nLen;
        char szModName[MAX_PATH];

        if (mbi.State == MEM_FREE)
        mbi.AllocationBase = mbi.BaseAddress;

        if ((mbi.AllocationBase == hInstDll) ||
            (mbi.AllocationBase != mbi.BaseAddress) ||
            (mbi.AllocationBase == NULL)) {
        // Do not add the module name to the list
        // if any of the following is true:
        // 1. If this region contains this DLL
        // 2. If this block is NOT the beginning of a region
        // 3. If the address is NULL
        nLen = 0;
        } else {
        nLen = GetModuleFileNameA((HINSTANCE) mbi.AllocationBase, 
            szModName, _countof(szModName));
        }

        if (nLen > 0) {
        wsprintfA(strchr(szBuf, 0), "\n%p-%s", 
            mbi.AllocationBase, szModName);
        }

        pb += mbi.RegionSize;
    }

I am getting the result on szBuf.

This function is part of a DLL file so that it is harder for me to debug.

Right now the DLL is compiled as x64 binary and i am using it against x64 processes.

P.S i know about EnumProcessModules and i am not using it with a reason (too long:).

score 1 · Accepted Answer · answered Dec 26 '12 at 15:33

GetModuleFileName() only gives you the name for modules loaded in your process, not the other process. It will give you a few hits by accident, the Windows operating system DLLs will get loaded at the same address and will thus have the same module handle value.

You will need to use GetModuleFileNameEx() so you can pass the process handle.

Do note the fundamental flaw with your code as posted, you are not doing anything to ensure that you can safely use VirtualQueryEx() on another process. Which requires that you suspend all its threads so it cannot allocate memory while you are iterating it, the kind of thing a debugger does. Also required for EnumProcessModules. The failure mode is nasty, it is random and it can easily get your loop stuck, iterating the same addresses over and over again. Which is why the CreateToolHelp32Snapshot() function exists, emphasis on "snapshot".

one more addition to the answer is that if you use GetModuleFileNameEx() you should use PROCESS_VM_READ on the OpenProcess too. Thanks. — Hanan, Dec 27 '12 at 08:10

Using VirtualQueryEx to enumerate modules at remote process doesn't return all modules

1 Answers1