还原GetModuleFileNameExW-CSDN博客

本文链接：https://blog.csdn.net/Vizee/article/details/8579175

本文介绍了如何使用Windbg及相关API来实现GetModuleFileNameExW功能，通过遍历进程的内存模块列表获取模块的完整路径。代码中包含FindModule函数，用于查找指定进程中的模块，并在成功后通过GetModuleFileNameExW函数复制模块名到缓冲区。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

//thanks for powerful windbg~

BOOL FindModule(HANDLE hProcess, HMODULE hModule, PLDR_DATA_TABLE_ENTRY pLdrData)
{
	DWORD i;
	PLIST_ENTRY pListEntry;
	PPEB_LDR_DATA pPebLdr;
	PROCESS_BASIC_INFORMATION pbi;
	NTSTATUS Status;

	Status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL);

	if(!NT_SUCCESS(Status)) {
		SetLastError(RtlNtStatusToDosError(Status));
		return FALSE;
	}
	
	if(hModule == NULL) {
		if(!ReadProcessMemory(hProcess, &(pbi.PebBaseAddress->ImageBaseAddress), &hModule, sizeof(hModule), NULL))
			return FALSE;
	}

	if(!ReadProcessMemory(hProcess, &(pbi.PebBaseAddress->Ldr), &pPebLdr, sizeof(pPebLdr), NULL))
		return 0;

	if(pPebLdr) {

		if(!ReadProcessMemory(hProcess, &(pPebLdr->InMemoryOrderModuleList), &pListEntry, sizeof(pListEntry), NULL))
			return FALSE;

		i = 0;
		while(pListEntry != &(pPebLdr->InMemoryOrderModuleList)) {
			if(!ReadProcessMemory(hProcess, (PBYTE)pListEntry - sizeof(LIST_ENTRY), pLdrData, sizeof(LDR_DATA_TABLE_ENTRY), NULL))
				return FALSE;
			if(pLdrData->DllBase == hModule)
				return TRUE;
			pListEntry = pLdrData->InMemoryOrderLinks.Flink;
			if(++i <= 10000)
				continue;
		}
	}

	SetLastError(ERROR_INVALID_HANDLE);
	return FALSE;
}

//alias K32GetModuleFileNameExW on windows 7
DWORD GetModuleFileNameExW(HANDLE hProcess, HMODULE hModule, LPWSTR lpFileName, DWORD nSize)
{
	DWORD dwLength;
	LDR_DATA_TABLE_ENTRY LdrData;

	if(!FindModule(hProcess, hModule, &LdrData))
		return 0;

	nSize += nSize;
	dwLength = nSize;

	if(LdrData.FullDllName.Length + sizeof(WCHAR) < nSize)
		nSize = LdrData.FullDllName.Length + sizeof(WCHAR);

	if(!ReadProcessMemory(hProcess, LdrData.FullDllName.Buffer, lpFileName, nSize, NULL))
		return 0;

	if(nSize == LdrData.FullDllName.Length + sizeof(WCHAR))
		nSize -= sizeof(WCHAR);

	if(nSize < dwLength)
		lpFileName[nSize >> 1] = L'\0';
	else if(dwLength > 0)
		lpFileName[(dwLength >> 1) - 1] = L'\0';

	return (nSize >> 1);
}