Windows program entry point using EnumProcessModules returns unexpected value

Question

I am running a simple app and trying to read a specific offset within it's memory using Window's PSAPI.
when I run my debugger, I get the real value of the memory address, and the relative one to my ".exe" entry point.
yet, when I run the following code, the base module I get as an entry point together with my offset yields a different address(it's wrong, and off by a few (hexa)demical points). what might be the problem?

ReadMemory is a template for ReadProcessMemory

    HWND   WINDOW_HANDLE;
HANDLE PROC_HANDLE;
DWORD PROC_ID;
DWORD address;
SIZE_T bytesRead; 

int InitReadMemory(const char* windowClass,const char* caption, DWORD addressOffset)
{

    DWORD cbNeeded;
    DWORD dwdResult;
    HMODULE mainModule;
    BOOL enumResult;

    //Get the window handle
    WINDOW_HANDLE = FindWindow(windowClass, NULL);
    if(WINDOW_HANDLE == NULL)
    {
        //Window was not foud
        return 10;
    }

    //Get the process ID
    dwdResult = GetWindowThreadProcessId(WINDOW_HANDLE, &PROC_ID);
    if(dwdResult==0)
    {
        //Getting Process ID failed
        return 20;
    }

    //Open the process
    PROC_HANDLE = OpenProcess(PROCESS_ALL_ACCESS, false, PROC_ID);

    if(PROC_HANDLE==NULL)
    {
        //Process failed to open
        return 30;
    }

    /*
     *Get the Main Module-
     *first entry in the returned HMODULE array from
     *EnumProcessModules
     */
    enumResult = EnumProcessModules(PROC_HANDLE, &mainModule, sizeof(HMODULE), &cbNeeded);

    if(enumResult != 0)
    {
        //Failed enumerating process modules
        return 40;
    }

    //offset the requested memory address from the application's base address
    address = (DWORD)((UINT_PTR)mainModule + addressOffset);  

#ifdef DEBUG        
    using namespace std;
    char filenameBuffer[64]="";


    string number;
    stringstream stristream;


    stristream << address;
    stristream >> number;
    cout << number << "\r\n" << endl;

    GetModuleFileNameEx(PROC_HANDLE, mainModule , filenameBuffer, 256);
    cout << (byte)ReadMemory<byte>() << "\r\n" << number << "\r\n" << filenameBuffer << endl;
system("PAUSE");
#endif

return 1;}

thank you in advance :)

P.S. I'm mostly just looking for pointers ... bah dum tsss

Update: apparently, checking for GetLastError value, EnumProcessModules prompts a 299 error code after it is done. and debugging shows that mainModule holds nothing... yet EnumProcessModules returns 0 as in "no errors".

yesterday, I managed to get it AND get GetModuleFileName to work propery(same code, only added GetLastError).

score 0 · Answer 1 · answered Oct 08 '16 at 06:29

Apparently, my problem was that I was running the tests with the snippet

enumResult = EnumProcessModules(PROC_HANDLE, &mainModule, sizeof(HMODULE), &cbNeeded)
if(enumResult != 0)
{
    //Failed enumerating process modules
    return 40;
}

and a successful run of EnumProcessModules yields a nonzero result! (thus causing me some confusion and faulted my whole debugging process)

after I figured this detail out, I ran some old tests again and found out that my target process is 64 bit, while I was running a 32 bit application. changed to 64bit and now it works like a charm

Windows program entry point using EnumProcessModules returns unexpected value

1 Answers1