Skip to content

Instantly share code, notes, and snippets.

@rbmm
Created February 7, 2024 17:46
Show Gist options
  • Save rbmm/5c590c266305cb6b33dfde99b565ab33 to your computer and use it in GitHub Desktop.
Save rbmm/5c590c266305cb6b33dfde99b565ab33 to your computer and use it in GitHub Desktop.
void ListModules()
{
PLIST_ENTRY InLoadOrderModuleList = &NtCurrentTeb()->ProcessEnvironmentBlock->Ldr->InLoadOrderModuleList;
PLDR_DATA_TABLE_ENTRY cursor = CONTAINING_RECORD(InLoadOrderModuleList->Flink, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
while (InLoadOrderModuleList != &cursor->InLoadOrderLinks)
{
DbgPrint("%p %wZ\r\n", cursor->DllBase, &cursor->BaseDllName);
cursor = CONTAINING_RECORD(cursor->InLoadOrderLinks.Flink, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment