R3枚举进程模块的方法

HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
	if (hSnapshot == INVALID_HANDLE_VALUE)
	{
		_tprintf(_T("CreateToolhelp32Snapshot Error\r\n"));
		return;
	}
	MODULEENTRY32 moduleEntry;
	moduleEntry.dwSize = sizeof(moduleEntry);
	TCHAR lpstrModuleFileName[260];
	
	int count = 0;
	if (Module32First(hSnapshot, &moduleEntry))
	{
		while (Module32Next(hSnapshot, &moduleEntry))
		{
			count++;
			GetModuleFileName(moduleEntry.hModule, lpstrModuleFileName, sizeof(lpstrModuleFileName));
		
			_tprintf(_T("第%d个模块  名称为：%s 基地址:0x%08x 大小:%d\r\n"), count, lpstrModuleFileName, moduleEntry.modBaseAddr, moduleEntry.modBaseSize);
		}
	}

HMODULE hmProcess[1000];
	DWORD dwNeeded = 0;
	TCHAR lpstrModuleFileName[260];
	EnumProcessModules(GetCurrentProcess(), hmProcess, sizeof(hmProcess), &dwNeeded);
	DWORD dwModuleCount = dwNeeded / sizeof(DWORD);
	MODULEINFO moduleInfo;
	for (int i = 0; i < dwModuleCount; i++)
	{
		
		GetModuleFileName(hmProcess[i], lpstrModuleFileName, sizeof(lpstrModuleFileName));
		GetModuleInformation(GetCurrentProcess(), hmProcess[i], &moduleInfo, sizeof(moduleInfo));
		_tprintf(_T("第%d个模块  名称为：%s  基地址:0x % 08x 大小 : % d 入口点 : 0x % 08x\r\n"), (i+1), lpstrModuleFileName, moduleInfo.lpBaseOfDll, moduleInfo.SizeOfImage, moduleInfo.EntryPoint);
	}

#include<iostream>
#include<Windows.h>
#include <Winternl.h> 
#include<tchar.h>


typedef NTSTATUS(NTAPI* LPFN_NTQUERYINFORMATIONPROCESS)(IN HANDLE ProcessHandle,
	IN PROCESSINFOCLASS ProcessInformationClass,
	OUT PVOID ProcessInformation,
	IN ULONG ProcessInformationLength,
	OUT PULONG ReturnLength OPTIONAL);

void _tmain()
{
	HMODULE hModule = NULL;
	LPFN_NTQUERYINFORMATIONPROCESS _NtQueryInformationProcess = NULL;
	_PROCESS_BASIC_INFORMATION ProcessbBasicInfo = { 0 };
	ULONG NeededLen = 0;
	NTSTATUS Status = FALSE;
	PPEB_LDR_DATA Ldr = NULL;
	PLIST_ENTRY InMemoryOrderModuleList = NULL;
	PLIST_ENTRY Current = NULL;
	PLDR_DATA_TABLE_ENTRY Entry = NULL;
	_tsetlocale(LC_ALL, _T("Chinese-simplified"));//使当前程序支持中文

	//使用NtQueryInformationProcess获取InMemoryOrderLinks地址
	hModule = GetModuleHandle(_T("ntdll.dll"));
	if (hModule == NULL)
	{
		printf("GetModuleHandle fail.\r\n");
		return;
	}

	_NtQueryInformationProcess = (LPFN_NTQUERYINFORMATIONPROCESS)GetProcAddress(hModule, "NtQueryInformationProcess");
	if (_NtQueryInformationProcess == NULL)
	{
		printf("GetProcAddress fail.\r\n");
		return;
	}


	Status = _NtQueryInformationProcess(GetCurrentProcess(), ProcessBasicInformation, &ProcessbBasicInfo, sizeof(ProcessbBasicInfo), &NeededLen);
	if (!NT_SUCCESS(Status))
	{
		_tprintf(_T("NtQueryInformationProcess fail.\r\n"));
		return;
	}

	Ldr = ProcessbBasicInfo.PebBaseAddress->Ldr;
	Current = Ldr->InMemoryOrderModuleList.Flink;
	do
	{
		Entry = (PLDR_DATA_TABLE_ENTRY)Current;
		_tprintf(_T("DllName:%s\t DllBase:0x:%x\r\n"), Entry->FullDllName.Buffer,Entry->DllBase);
		Current = Current->Flink;
	} while (Current!=NULL&&Current->Flink !=&Ldr->InMemoryOrderModuleList);


	_tprintf(_T("input anykey to exit\r\n"));
	_gettchar();


}