Traverse the process module through Teb

# Include "stdafx. H "# include <iostream> # include <tchar. h> # include <windows. h> typedef struct _ peb_ldr_data {uint length; byte initialized; void * sshandle; list_entry comment;} peb_ldr_data, * comment; typedef struct _ peb {byte comment; byte bitfield; void * mutant; void * imagebaseaddress; ppeb_ldr_data LDR;} peb, * ppeb; typedef s Truct _ client_id {pvoid uniqueprocess; pvoid sequence;} client_id, * pclient_id; typedef struct _ Teb {nt_tib Tib; pvoid sequence; client_id CID; pvoid activerpcinfo; pvoid sequence; ppeb ;} teb, * pteb; typedef pteb (ntapi * handle) (); typedef struct _ unicode_string {ushort length; ushort maximumlength; pwstr buffer;} unicode_string, * punicode_string; typedef struct _ L Response {list_entry inloadorderlinks; list_entry response; pvoid dllbase; pvoid entrypoint; ulong sizeofimage; unicode_string fulldllname; unicode_string basedllname;} _ response, * response; char * W2C (char * pcstr, const wchar_t * pwstr, size_t Len) {int nlength = wcslen (pwstr); // get the converted length int nbytes = widechartomultib Yte (0, // specify the code page used to perform the conversion0, // no special flags to handle unmapped characterspwstr, // wide character string to convertnlength, // The number of wide characters in that stringnull, // No output buffer given, we just want to know how long it needs to be0, null, // no replacement character givennull ); // We don't want to know if a character didn't make it throug H The translation // make sure the buffer is big enough for this, making it larger if necessaryIf (nbytes> Len) nbytes = Len; // The result obtained through the above, convert Unicode characters to ASCII characters widechartomultibyte (0, // specify the code page used to perform the conversion0, // no special flags to handle unmapped characterspwstr, // wide character string to convertnlength, // The number of wide characters in that stringpcstr, // put Output ASCII characters at the end of the buffernbytes, // There is at least this much space therenull, // no replacement character givennull); Return pcstr;} void show () {funcntcurrentteb NGT = (funcntcurrentteb) getprocaddress (getmodulehandle (_ T ("NTDLL. DLL ")," ntcurrentteb "); pteb = NGT (); ppeb = pteb-> peb; ppeb_ldr_data ppld = ppeb-> LDR; repeated pldte = (pldr_data_table _ Entry) ppld-> inloadordermodulelist. flink; bool bfound = false; while (! Bfound & pldte-> dllbase! = NULL) {char szdll [max_path]; memset (szdll, 0x00, max_path); W2C (szdll, pldte-> basedllname. buffer, pldte-> basedllname. length); _ tprintf (_ T ("% s \ r \ n"), szdll); pldte = (pldr_data_table_entry) (list_entry *) (pldte )) -> flink ;}} int _ tmain (INT argc, _ tchar * argv []) {getchar (); show (); return 0 ;}