| MessageBox (getactivewindow (), "list DLL files loaded by this program", "", mb_ OK );
Memory_basic_information MBI;
Pbyte PTR = NULL;
DWORD dwbytesreturn = sizeof (memory_basic_information );
Char szbuffer [256*100] = "";
Char szmodufile [240] = "";
Char sztmpbuffer [256] = "";
While (dwbytesreturn = sizeof (memory_basic_information ))
{
Dwbytesreturn = virtualquery (PTR, & MBI, sizeof (memory_basic_information ));
If (MBI. type = mem_free)
{
MBI. allocationbase = MBI. baseaddress;
}
Getmodulefilename (hinstance) MBI. allocationbase, szmodufile, 240 );
Sprintf (sztmpbuffer, "[module: % x-% s]/R/N", MBI. allocationbase, szmodufile );
If (MBI. allocationbase = MBI. baseaddress &&
MBI. allocationbase! = NULL &&
MBI. allocationbase! = Getmodulehandle (null) strcat (szbuffer, sztmpbuffer );
PTR + = MBI. regionsize;
}
// Add yourCode, Put the generated information into an editing box for viewing, or store the file
Technical introduction to the program
Virtualquery is easy to get memory information
Typedef struct _ memory_basic_information {// MBI
Pvoid baseaddress; // base address of Region
Pvoid allocationbase; // allocation base address
DWORD allocationprotect; // initial access protection
DWORD regionsize; // size, in bytes, of Region
DWORD state; // committed, reserved, free
DWORD protect; // current access protection
DWORD type; // type of pages
} Memory_basic_information;
Typedef memory_basic_information * pmemory_basic_information;
This structure, in our program, is most concerned with allocationbase, baseaddress can be seen from the code
Allocationbase is equivalent to hmodule.
Regionsize indicates the size of the memory.
PTR + = MBI. regionsize;
Let's get the information of the next memory block.
Through getmodulefilename, we get the detailed information of the module.
|