#pragma pack(8)
typedef struct _PROCESS_BASIC_INFORMATION64 {
NTSTATUS ExitStatus;
UINT32 Reserved0;
UINT64 PebBaseAddress;
UINT64 AffinityMask;
UINT32 BasePriority;
UINT32 Reserved1;
UINT64 UniqueProcessId;
UINT64 InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION64;
#pragma pack()
typedef
NTSTATUS(WINAPI *pfnNtWow64QueryInformationProcess64)
(HANDLE ProcessHandle, UINT32 ProcessInformationClass,
PVOID ProcessInformation, UINT32 ProcessInformationLength,
UINT32* ReturnLength);
typedef
NTSTATUS(WINAPI *pfnNtWow64ReadVirtualMemory64)
(HANDLE ProcessHandle, PVOID64 BaseAddress,
PVOID BufferData, UINT64 BufferLength,
PUINT64 ReturnLength);
typedef
NTSTATUS(WINAPI *pfnNtWow64ReadVirtualMemory64_Bin)
(HANDLE ProcessHandle, PVOID BufferData,
LPCTSTR ModuleName, UINT64 BufferLength,
PUINT64 ReturnLength);
long long GetModuleHandle64(HANDLE processHandle,LPCTSTR ModuleName)
{
PROCESS_BASIC_INFORMATION64 pbi64;
int ret;
long long ldr;
long long ModuleHandle;
long long pName;
HMODULE NtdllModule = GetModuleHandle(L"ntdll.dll");
pfnNtWow64QueryInformationProcess64 NtWow64QueryInformationProcess64 = (pfnNtWow64QueryInformationProcess64)GetProcAddress(NtdllModule, "NtWow64QueryInformationProcess64");
pfnNtWow64ReadVirtualMemory64 NtWow64ReadVirtualMemory64 = (pfnNtWow64ReadVirtualMemory64)GetProcAddress(NtdllModule, "NtWow64ReadVirtualMemory64");
pfnNtWow64ReadVirtualMemory64_Bin NtWow64ReadVirtualMemory64_Bin = (pfnNtWow64ReadVirtualMemory64_Bin)GetProcAddress(NtdllModule, "NtWow64ReadVirtualMemory64_Bin");
ret = NtWow64QueryInformationProcess64(processHandle, 0, &pbi64, 48, 0);
if (ret == 0)
{
return 0;
}
NtWow64ReadVirtualMemory64(processHandle, (PVOID64)(pbi64.PebBaseAddress + 24), &ldr, 8, 0);
NtWow64ReadVirtualMemory64(processHandle, (PVOID64)(ldr + 24), &ldr, 8, 0);
do
{
NtWow64ReadVirtualMemory64(processHandle, (PVOID64)(ldr + 48), &ModuleHandle, 8, 0);
if (ModuleHandle != 0)
{
break;
}
NtWow64ReadVirtualMemory64(processHandle, (PVOID64)(ldr + 96), &pName, 8, 0);
NtWow64ReadVirtualMemory64_Bin(processHandle, &pName, ModuleName, sizeof(ModuleName), 0);
} while (ModuleHandle != 0);
return ModuleHandle;
}