PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
modules_enum.cpp
Go to the documentation of this file.
1#include "modules_enum.h"
2
3#include <psapi.h>
4#pragma comment(lib,"psapi.lib")
5
6size_t pesieve::util::enum_modules(IN HANDLE hProcess, IN OUT HMODULE hMods[], IN const DWORD hModsMax, IN DWORD filters) //throws exceptions
7{
8 if (hProcess == nullptr) {
9 return 0;
10 }
11 const char err_msg[] = "Could not enumerate modules. ";
12 DWORD cbNeeded;
13#ifdef _WIN64
14 if (!EnumProcessModulesEx(hProcess, hMods, hModsMax, &cbNeeded, filters)) {
15 throw std::runtime_error(err_msg);
16 return 0;
17 }
18#else
19 /*
20 Some old, 32-bit versions of Windows do not have EnumProcessModulesEx,
21 but we can use EnumProcessModules for the 32-bit version: it will work the same and prevent the compatibility issues.
22 */
23 if (!EnumProcessModules(hProcess, hMods, hModsMax, &cbNeeded)) {
24 throw std::runtime_error(err_msg);
25 return 0;
26 }
27#endif
28 const size_t modules_count = cbNeeded / sizeof(HMODULE);
29 return modules_count;
30}
size_t enum_modules(IN HANDLE hProcess, IN OUT HMODULE hMods[], IN const DWORD hModsMax, IN DWORD filters)
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle