PVOID FindRemoteImageBase(HANDLE hProcess, PPEB pPEB, char* pModuleName)
{
PPEB_LDR_DATA pLoaderData = ReadRemoteLoaderData(hProcess, pPEB);
PVOID firstFLink = pLoaderData->InLoadOrderModuleList.Flink;
PVOID fLink = pLoaderData->InLoadOrderModuleList.Flink;
PLDR_MODULE pModule = new LDR_MODULE();
do
{
BOOL bSuccess = ReadProcessMemory
(
hProcess,
fLink,
pModule,
sizeof(LDR_MODULE),
0
);
if (!bSuccess)
return 0;
PWSTR pwBaseDllName = new WCHAR[pModule->BaseDllName.MaximumLength];
bSuccess = ReadProcessMemory
(
hProcess,
pModule->BaseDllName.Buffer,
pwBaseDllName,
pModule->BaseDllName.Length + 2,
0
);
if (bSuccess)
{
size_t sBaseDllName = pModule->BaseDllName.Length / 2 + 1;
char* pBaseDllName = new char[sBaseDllName];
WideCharToMultiByte
(
CP_ACP,
0,
pwBaseDllName,
pModule->BaseDllName.Length + 2,
pBaseDllName,
sBaseDllName,
0,
0
);
if (!_stricmp(pBaseDllName, pModuleName))
return pModule->BaseAddress;
}
fLink = pModule->InLoadOrderModuleList.Flink;
} while (pModule->InLoadOrderModuleList.Flink != firstFLink);
return 0;
}
PVOID IATHookInjector::FindRemoteImageBase(HANDLE hProcess, PPEB pPEB, char* pModuleName) const
{
auto pLoaderData = ReadRemoteLoaderData(hProcess, pPEB);
PVOID firstFLink = pLoaderData->InLoadOrderModuleList.Flink;
PVOID fLink = pLoaderData->InLoadOrderModuleList.Flink;
auto pModule = new LDR_MODULE();
do
{
auto bSuccess = ReadProcessMemory(hProcess, fLink, pModule, sizeof(LDR_MODULE), nullptr);
if (!bSuccess)
{
return nullptr;
}
auto pwBaseDllName = new WCHAR[pModule->BaseDllName.MaximumLength];
bSuccess = ReadProcessMemory(hProcess, pModule->BaseDllName.Buffer, pwBaseDllName, pModule->BaseDllName.Length + 2, nullptr);
if (bSuccess)
{
size_t sBaseDllName = pModule->BaseDllName.Length / 2 + 1;
auto pBaseDllName = new char[sBaseDllName];
WideCharToMultiByte(CP_ACP, 0, pwBaseDllName, pModule->BaseDllName.Length + 2, pBaseDllName, sBaseDllName, nullptr, nullptr);
if (!_stricmp(pBaseDllName, pModuleName))
{
return pModule->BaseAddress;
}
}
fLink = pModule->InLoadOrderModuleList.Flink;
}
while (pModule->InLoadOrderModuleList.Flink != firstFLink);
return nullptr;
}
