Created
June 13, 2020 06:08
-
-
Save igorsegallafa/1623ab0a816be5ddb3e1d469e874747e to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| if( ( hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, GetCurrentProcessId() ) ) != INVALID_HANDLE_VALUE ) | |
| { | |
| me32.dwSize = sizeof( me32 ); | |
| if( Module32First( hModuleSnap, &me32 ) ) | |
| { | |
| do | |
| { | |
| if( me32.hModule == GetModuleHandle( NULL ) ) | |
| continue; | |
| PIMAGE_DOS_HEADER pdosheader = (PIMAGE_DOS_HEADER)me32.modBaseAddr; | |
| PIMAGE_NT_HEADERS pntheaders = (PIMAGE_NT_HEADERS)( (DWORD)me32.modBaseAddr + pdosheader->e_lfanew ); | |
| PIMAGE_SECTION_HEADER psectionheader = (PIMAGE_SECTION_HEADER)(pntheaders + 1); | |
| if( !IsKnownDLL( me32.szExePath, pntheaders->Signature, szModuleName ) ) | |
| { | |
| //Unknown DLL Detected! | |
| //Do something... | |
| break; | |
| } | |
| } while( Module32Next( hModuleSnap, &me32 ) ); | |
| } | |
| } | |
| CloseHandle( hModuleSnap ); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Nice work!!!
You can pass me this variables definitions?