利用peb枚举当前进程加载模块

其实就是根据http://blog.csdn.net/iiprogram/archive/2006/03/22/632573.aspx上的c代码写的

希望作者不会鄙视我

include /masm32/include/windows.inc

include /masm32/include/kernel32.inc
include /masm32/include/user32.inc
includelib /masm32/lib/kernel32.lib
includelib /masm32/lib/user32.lib

.data
stdOut dd ?
format db "%ls",0
rt dw 0d0ah
.data?
buffer db MAX_PATH dup(?)
.code
start:
invoke GetStdHandle,STD_OUTPUT_HANDLE
mov stdOut,eax
assume fs:nothing
mov   eax,fs:[18h]
mov   eax,dword ptr [eax+30h]
mov   eax,dword ptr [eax+0ch]
mov   eax,dword ptr [eax+0ch]
.repeat
mov  ebx,eax
mov   eax,dword ptr [eax+28h]
invoke wsprintf,addr buffer,addr format,eax
invoke lstrlen,addr buffer
invoke WriteFile,stdOut,addr buffer,eax,0,NULL
invoke WriteFile,stdOut,addr rt,2,0,NULL
mov  eax,dword ptr [ebx]
mov  ecx,dword ptr [eax+18h]
.until (ecx==NULL)
invoke ExitProcess,NULL
end start