VB and VBA Users Source Code: Determining all the modules (DLLs/OCXs) loaded by a process
[
Home
|
Contents
|
Search
|
Reply
| Previous | Next ]
VB/VBA Source Code
Determining all the modules (DLLs/OCXs) loaded by a process
By:
Andrew Baker
Email (spam proof):
Email the originator of this post
Date:
Tuesday, August 06, 2002
Hits:
847
Category:
Windows API
Article:
The following code lists all the DLLs/OCXs loaded by a given process. Option Explicit Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Private Declare Function EnumProcessModules Lib "PSAPI.DLL" (ByVal hProcess As Long, lphModule As Long, ByVal cb As Long, lpcbNeeded As Long) As Long Private Declare Function GetModuleInformation Lib "PSAPI" (ByVal hProcess As Long, ByVal hModule As Long, LPMODULEINFO As MODULEINFO, cb As Long) As Boolean Private Declare Function GetModuleFileNameEx Lib "PSAPI" Alias "GetModuleFileNameExA" (ByVal hProcess As Long, ByVal hModule As Long, ByVal lpFilename As String, nSize As Long) As Boolean Private Declare Function GetModuleBaseName Lib "PSAPI.DLL" Alias "GetModuleBaseNameA" (ByVal hProcess As Long, ByVal hModule As Long, ByVal lpFilename As String, ByVal nSize As Long) As Long Private Declare Sub CloseHandle Lib "kernel32" (ByVal hPass As Long) Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long Private Type MODULEINFO lpBaseOfDll As Long SizeOfImage As Long EntryPoint As Long End Type 'Purpose : Returns the names of all the modules being used by a specified process identifier 'Inputs : lProcessID The Process ID to return the modules for. ' asModuleInfo See Outputs ' [sFilter] Filter the modules returned using this string 'Outputs : Returns a count of the modules being used ' asModuleInfo A one based 2d string array containing module information (header row is included) ' asModuleInfo(1, x) = "Module ID" ' asModuleInfo(2, x) = "Module Name" ' asModuleInfo(3, x) = "Base Addr" ' asModuleInfo(4, x) = "Module Path" ' asModuleInfo(5, x) = "Size Of Image" ' asModuleInfo(6, x) = "Entry Point" ' Where x is the module index 'Author : Andrew Baker 'Date : 01/11/2000 13:17 'Notes : 'Revisions : 'Assumptions : Private Function ProcessInfo(lProcessID As Long, ByRef asModuleInfo() As String, Optional sFilter As String = "") As Long Const MAX_PATH As Integer = 260 Const PROCESS_QUERY_INFORMATION = &H400& Const PROCESS_VM_READ = &H10& Const OPEN_PROCESS_FLAGS = PROCESS_QUERY_INFORMATION& Or PROCESS_VM_READ& Dim bFilterModule As Boolean Dim lCountMatching As Long Dim bRetVal As Boolean Dim lNeeded As Long Dim lNumItems As Long Dim lThisModule As Long Dim sModuleName As String Dim sModuleFileName As String Dim lNumCols As Long Dim lNumRows As Long Dim lProcessHwnd As Long Dim lPos As Long Dim lLenFileName As Long Dim alModules() As Long Dim tModuleInfo As MODULEINFO Dim lBaseOfDLL As Long Dim lSizeOfImage As Long Dim lEntryPoint As Long On Error GoTo ErrFailed 'Open the process lProcessHwnd = OpenProcess(OPEN_PROCESS_FLAGS, 0&, lProcessID) If lProcessHwnd = 0 Then 'Failed to open process Exit Function End If 'Enum modules lNumItems = 1024 ReDim alModules(0 To lNumItems) If EnumProcessModules(lProcessHwnd, alModules(0), (1024 * 4), lNeeded) = False Then ' Exit cleanly if this fails Exit Function End If 'Calc number of modules returned lNumItems = lNeeded / 4 lNumRows = lNumItems lNumCols = 6 ReDim asModuleInfo(1 To 6, 1 To 1) 'Add array titles asModuleInfo(1, 1) = "Module ID" asModuleInfo(2, 1) = "Module Name" asModuleInfo(3, 1) = "Base Addr" asModuleInfo(4, 1) = "Module Path" asModuleInfo(5, 1) = "Size Of Image" asModuleInfo(6, 1) = "Entry Point" 'Loop over modules For lThisModule = 0 To lNumItems - 1 If alModules(lThisModule) <> 0 Then sModuleFileName = "" sModuleName = "" 'Get module information bRetVal = GetModuleInformation(lProcessHwnd, alModules(lThisModule), tModuleInfo, lNeeded) lBaseOfDLL = tModuleInfo.lpBaseOfDll lSizeOfImage = tModuleInfo.SizeOfImage lEntryPoint = tModuleInfo.EntryPoint If bRetVal = False Then sModuleFileName = "Unknown" sModuleName = "Unknown" Else 'Get Module File Name lLenFileName = MAX_PATH sModuleFileName = String$(lLenFileName, Chr$(0)) bRetVal = GetModuleFileNameEx(lProcessHwnd, alModules(lThisModule), sModuleFileName, lLenFileName) lPos = InStr(sModuleFileName, Chr$(0)) If lPos > 0 Then sModuleFileName = Mid$(sModuleFileName, 1, lPos - 1) End If 'Get Module Name lLenFileName = MAX_PATH sModuleName = Space$(lLenFileName) bRetVal = GetModuleBaseName(lProcessHwnd, alModules(lThisModule), sModuleName, lLenFileName) lPos = InStr(sModuleName, Chr$(0)) If lPos > 0 Then sModuleName = Mid$(sModuleName, 1, lPos - 1) End If End If bFilterModule = False If Len(sFilter) Then 'Check filter If (UCase$(sModuleFileName) Like UCase$("*" & sFilter)) = False Then bFilterModule = True Else bFilterModule = False End If End If If bFilterModule = False Then lCountMatching = lCountMatching + 1 ReDim Preserve asModuleInfo(1 To 6, 1 To lCountMatching + 1) asModuleInfo(1, lCountMatching + 1) = alModules(lThisModule) asModuleInfo(2, lCountMatching + 1) = sModuleName asModuleInfo(3, lCountMatching + 1) = lBaseOfDLL asModuleInfo(4, lCountMatching + 1) = sModuleFileName asModuleInfo(5, lCountMatching + 1) = lSizeOfImage asModuleInfo(6, lCountMatching + 1) = lEntryPoint End If Else 'No module ID End If Next Erase alModules Call CloseHandle(lProcessHwnd) ProcessInfo = lCountMatching Exit Function ErrFailed: Debug.Print "Error in ProcessInfo: " & Err.Description Debug.Assert False Call CloseHandle(lProcessHwnd) ProcessInfo = -1 Erase asModuleInfo End Function 'Demonstration routine, displays all the modules (DLLs/OCXs) loaded by the current process Sub Test() Dim lThisMod As Long, lNumMods As Long, asProcInfo() As String Dim sThisMod As String, lThisItem As Long lNumMods = ProcessInfo(GetCurrentProcessId, asProcInfo) Debug.Print "------Modules (DLLs/OCXs) loading into current process----------" For lThisMod = 1 To lNumMods sThisMod = "" For lThisItem = 1 To UBound(asProcInfo) sThisMod = sThisMod & vbTab & vbTab & asProcInfo(lThisItem, lThisMod) Next Debug.Print sThisMod Next End Sub
Terms and Conditions
Support this site
Download a trial version of the Excel Workbook Rebuilder
