Developer Forum

Hi,


I am using PEB and LDR_DATA_TABLE_ENTRY (kernel level) for enumerating
modules from process space, but I got trouble with it for Windows XP
x64 - I can enumerate only 64-bit modules for 32-bit processes. Maybe
somebody knows how to get access to information about 32-bit modules
too.


Thanks.

The documented way is to use TH32CS_SNAPMODULE32
and TH32CS_SNAPMODULE from a 64-bit application.

See a discussion in
http://www.yqcomputer.com/ +Brugiolo+TH32CS_SNAPMODULE32&qt_s=Search

You can then reverse enginner the two PEBs if you feel
you need to go the undocumented way.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.yqcomputer.com/

Thanks for your answer.