Question

我想获取系统进程加载的模块的文件名。

因此我首先执行

System.Diagnostics.Process.EnterDebugMode（）;

进入调试模式并获取SEDebugPrivilege。

但是Module32First函数总是失败......

我做错了什么？

using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;

{
    public static class Toolhelp32
    {
        public const uint TH32CS_SNAPHEAPLIST = 0x00000001;
        public const uint TH32CS_SNAPPROCESS = 0x00000002;
        public const uint TH32CS_SNAPTHREAD = 0x00000004;
        public const uint TH32CS_SNAPMODULE = 0x00000008;
        public const uint TH32CS_SNAPMODULE32 = 0x00000010;
        public const uint TH32CS_SNAPALL = (TH32CS_SNAPHEAPLIST |
                                                 TH32CS_SNAPPROCESS |
                                                 TH32CS_SNAPTHREAD |
                                                 TH32CS_SNAPMODULE);
        public const uint TH32CS_INHERIT = 0x80000000;

        public const uint HF32_DEFAULT = 1;
        public const uint HF32_SHARED = 2;

        public const uint LF32_FIXED = 0x00000001;
        public const uint LF32_FREE = 0x00000002;
        public const uint LF32_MOVEABLE = 0x00000004;

        public struct HEAPLIST32
        {
            public uint dwSize;
            public uint th32ProcessID;
            public uint th32HeapID;
            public uint dwFlags;
        }

        public struct HEAPENTRY32
        {
            public uint dwSize;
            public IntPtr hHandle;
            public uint dwAddress;
            public uint dwBlockSize;
            public uint dwFlags;
            public uint dwLockCount;
            public uint dwResvd;
            public uint th32ProcessID;
            public uint th32HeapID;
        }


        public struct PROCESSENTRY32W
        {
            public uint dwSize;
            public uint cntUsage;
            public uint th32ProcessID;
            public UIntPtr th32DefaultHeapID;
            public uint th32ModuleID;
            public uint cntThreads;
            public uint th32ParentProcessID;
            public int pcPriClassBase;
            public uint dwFlags;
            public string szExeFile;
        }

        public struct PROCESSENTRY32
        {
            public uint dwSize;
            public uint cntUsage;
            public uint th32ProcessID;
            public uint th32DefaultHeapID;
            public uint th32ModuleID;
            public uint cntThreads;
            public uint th32ParentProcessID;
            public int pcPriClassBase;
            public uint dwFlags;
            public string szExeFile;
        }

        public struct THREADENTRY32
        {
            public uint dwSize;
            public uint cntUsage;
            public uint th32ThreadID;
            public uint th32OwnerProcessID;
            public int tpBasePri;
            public int tpDeltaPri;
            public uint dwFlags;
        }

        public struct MODULEENTRY32W
        {
            public uint dwSize;
            public uint th32ModuleID;
            public uint th32ProcessID;
            public uint GlblcntUsage;
            public uint ProccntUsage;
            public IntPtr modBaseAddr;
            public uint modBaseSize;
            public IntPtr hModule;
            [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] 
            public string szModule;
            [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)] 
            public string szExePath;
        }

        public struct MODULEENTRY32
        {
            public uint dwSize;
            public uint th32ModuleID;
            public uint th32ProcessID;
            public uint GlblcntUsage;
            public uint ProccntUsage;
            public IntPtr modBaseAddr;
            public uint modBaseSize;
            public IntPtr hModule;
            public string szModule;
            public string szExePath;
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr CreateToolhelp32Snapshot(uint dwFlags, uint th32ProcessID);

        [DllImport("kernel32.dll", SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool CloseHandle(IntPtr hSnapshot);

        [DllImport("kernel32.dll")]
        public static extern bool Heap32ListFirst(IntPtr hSnapshot, ref HEAPLIST32 lphl);

        [DllImport("kernel32.dll")]
        public static extern bool Heap32ListNext(IntPtr hSnapshot, ref HEAPLIST32 lphl);

        [DllImport("kernel32.dll")]
        public static extern bool Heap32First(IntPtr hSnapshot, ref HEAPENTRY32 lphe,
            uint th32ProcessID, uint th32HeapID);

        [DllImport("kernel32.dll")]
        public static extern bool Heap32Next(IntPtr hSnapshot, ref HEAPENTRY32 lphe);

        [DllImport("kernel32.dll")]
        public static extern bool Toolhelp32ReadProcessMemory(uint th32ProcessID,
            IntPtr lpBaseAddress, IntPtr lpBuffer, uint cbRead, IntPtr lpNumberOfBytesRead);

        [DllImport("kernel32.dll")]
        public static extern bool Process32FirstW(IntPtr hSnapshot, ref PROCESSENTRY32W lppe);

        [DllImport("kernel32.dll")]
        public static extern bool Process32NextW(IntPtr hSnapshot, ref PROCESSENTRY32W lppe);

        [DllImport("kernel32.dll")]
        public static extern bool Process32First(IntPtr hSnapshot, ref PROCESSENTRY32 lppe);

        [DllImport("kernel32.dll")]
        public static extern bool Process32Next(IntPtr hSnapshot, ref PROCESSENTRY32 lppe);

        [DllImport("kernel32.dll")]
        public static extern bool Thread32First(IntPtr hSnapshot, ref THREADENTRY32 lpte);

        [DllImport("kernel32.dll")]
        public static extern bool Thread32Next(IntPtr hSnapshot, ref THREADENTRY32 lpte);

        [DllImport("kernel32.dll")]
        public static extern bool Module32FirstW(IntPtr hSnapshot, ref MODULEENTRY32W lpme);

        [DllImport("kernel32.dll")]
        public static extern bool Module32NextW(IntPtr hSnapshot, ref MODULEENTRY32W lpme);

        [DllImport("kernel32.dll")]
        public static extern bool Module32First(IntPtr hSnapshot, ref MODULEENTRY32W lpme);

        [DllImport("kernel32.dll")]
        public static extern bool Module32Next(IntPtr hSnapshot, ref MODULEENTRY32W lpme);
    }
}

class GetProcessModuleFilenamesHelper
    {
        const int INVALID_HANDLE_VALUE = -1;
        const int ERROR_BAD_LENGTH = 0x18;
        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern int GetModuleFileName(HandleRef hModule, StringBuilder buffer, int length);

        public static List<Toolhelp32.MODULEENTRY32W> GetProcessModuleFilenames(int ProcId)
        {
            List<Toolhelp32.MODULEENTRY32W> lst = new List<Toolhelp32.MODULEENTRY32W>();

            IntPtr hModuleSnapshot = new IntPtr(ERROR_BAD_LENGTH);
            while (hModuleSnapshot == new IntPtr(ERROR_BAD_LENGTH))
            {
                hModuleSnapshot = Toolhelp32.CreateToolhelp32Snapshot(Toolhelp32.TH32CS_SNAPMODULE32|Toolhelp32.TH32CS_SNAPMODULE, (uint)ProcId);
                System.Windows.Forms.Application.DoEvents();
            }

            if (hModuleSnapshot != new IntPtr(INVALID_HANDLE_VALUE))
            {
                Toolhelp32.MODULEENTRY32W ModuleList = new Toolhelp32.MODULEENTRY32W();

                ModuleList.dwSize = (uint)Marshal.SizeOf(ModuleList);

                if (Toolhelp32.Module32First(hModuleSnapshot, ref ModuleList))
                {
                    do
                    {

                        Toolhelp32.MODULEENTRY32W ModuleEntry = new Toolhelp32.MODULEENTRY32W();
                        ModuleEntry.dwSize = (uint)Marshal.SizeOf(ModuleEntry);                                                                       

                        /*
                        if (Toolhelp32.Heap32First(hHeapSnapshot, ref HeapEntry, HeapList.th32ProcessID, HeapList.th32HeapID))
                        {
                            do
                            {
                                MemUsage += HeapEntry.dwBlockSize;
                            } while (Toolhelp32.Heap32Next(hHeapSnapshot, ref HeapEntry));
                        }
                       */

                        /*
                        StringBuilder buffer = new StringBuilder(260);
                        GetModuleFileName(ModuleEntry.hModule, buffer, buffer.Capacity);
                        string str = Path.GetFullPath(buffer.ToString());
                        str=str.Substring(0, str.LastIndexOf('\\'));
                        */
                        lst.Add(ModuleEntry);

                    } while (Toolhelp32.Module32Next(hModuleSnapshot, ref ModuleList));


                }

                int lasterr = Marshal.GetLastWin32Error();
                //System.Windows.Forms.MessageBox.Show(Marshal.GetLastWin32Error().ToString());

                Toolhelp32.CloseHandle(hModuleSnapshot);
            }

            return lst;
        }
    }

Answer 1

我收到了错误。我应该将ModuleList添加到List

获取系统进程模块文件名

1 个答案: