时间戳

首页 > 解决方案 > Get DLL Module size after DLL injection without GetModuleInformation

winapi - Get DLL Module size after DLL injection without GetModuleInformation

问题描述

I manual map dll and i can't get MODULEINFO for it's working region with GetModuleInformation (it's always answer for me with "Unable to obtain module")?. That happens because that function tries to get data from the module list in the process environment block. But a manually mapped dll is usually not linked in that list unless of course you manually add a new list entry. It doesn't use the info from the header (or at least not directly). So i already has dllBase that is hModule. So now i only need to get it's size. Is any way to get it without GetModuleInformation?

static void someFunc(HINSTANCE hModule)
{
    // all the vars we need for the GetModuleInformation call
    MODULEINFO modInfo;
    HANDLE hProcess = GetCurrentProcess();

    if (GetModuleInformation(hProcess, hModule, &modInfo, sizeof(MODULEINFO)))
    {
        // some work
    }
    else {
        std::cout << "Unable to obtain module" << std::endl;
    }
}

标签： winapidllinject

解决方案

如果我们想在自我过程中获取映射图像的图像大小 - 我们可以从SizeOfImage成员中读取它IMAGE_OPTIONAL_HEADER- 这是映射为内存中图像图像的大小（不是磁盘上的大小）

ULONG GetImageSize(PVOID ImageBase = &__ImageBase)
{
    if (PIMAGE_NT_HEADERS pinth = RtlImageNtHeader(ImageBase))
    {
        return pinth->OptionalHeader.SizeOfImage;
    }

    return 0;
}

推荐阅读