PEB中获取指定名称的DLL的基址

来源：互联网发布：淘宝培训心得编辑：程序博客网时间：2024/09/21 09:20

//先从PEB中获取指定名称的DLL的基址

ULONG GetModuleHandleFromProcessPEB(ULONG Peb,char *szDllName)
{
PPEB_LDR_DATA pLdrData;
PLDR_DATA_TABLE_ENTRY pLdrDataEntry;
PLIST_ENTRY pListHead,pListNext;
ANSI_STRING ansiDllName;
ULONG DllBase=0;
__try
{
  pLdrData=(PPEB_LDR_DATA)*(ULONG*)((char*)Peb+0xC);
  pListHead=&(pLdrData->InLoadOrderModuleList);
  pListNext=pListHead->Flink;
  for (pListHead;pListNext!=pListHead;pListNext=pListNext->Flink)
  {
   pLdrDataEntry=(PLDR_DATA_TABLE_ENTRY)pListNext;
   if (pLdrDataEntry->BaseDllName.Buffer)
   {
    RtlUnicodeStringToAnsiString(&ansiDllName,& (pLdrDataEntry->BaseDllName),TRUE);
    //dprintf("Base=0x%08X %s\n",pLdrDataEntry->DllBase,ansiDllName.Buffer);
    if (!_stricmp(szDllName,ansiDllName.Buffer))
    {
     DllBase=(ULONG)pLdrDataEntry->DllBase;
    }
    RtlFreeAnsiString(&ansiDllName);
    //若找到就退出循环
    if (DllBase) break;
   }//end of if

  }
  return DllBase;
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
  DbgPrint("Error occured while searching module in PEB.\n");
  return 0;
}
}