C++ 获取正在运行的进程的 DLL 的基址

Question

I am trying to read an address from a running process. In order to do this, I have determined the offset of the address from a certain dll of the running process. So far what I have done is I find the window, I than find the PID of the program and get the handle of it. From there I create a snapshot of the program using CreateToolhelp32Snapshot(), which allows me to loop through the modules of the program. From there I would like to get the base address of a specific module by name, however I am not sure how to get the name of the modules, this is my current code and where I am stuck. Is there a simple way I can get the name of the module based on the information I have?

// Find the window
hwnd = FindWindow(NULL, L"calculator");
if (!hwnd) {
    cout << "window not found\n";
    cin.get();
}

//Get Process ID
GetWindowThreadProcessId(hwnd, &pid);

HANDLE phandle = OpenProcess(PROCESS_VM_OPERATION, 0, pid);
if (!phandle) {
    cout << "could not get handle\n";
    cin.get();
}
if (snapshot_test != INVALID_HANDLE_VALUE) {

    // First module
    MODULEENTRY32 mod_entry;
    mod_entry.dwSize = sizeof(mod_entry);

    if (Module32First(snapshot_test, &mod_entry)) {
        do {
            DWORD test = (DWORD)(mod_entry.modBaseAddr + 0x46F68 + 10);
            cout << ReadProcessMemory(phandle, (void*)(test), &health, sizeof(health), 0);
        } while (Module32Next(snapshot_test, &mod_entry));
    }
    else (cout << "module32first error");
}
else (cout << "snapshot error")

Answer 1

The MODULEENTRY32.szModule variable contains the name of the module, and MODULEENTRY32.modBaseAddr contains the address of the module itself. You can use this function to get the address of a module by passing in it's name. It will loop through the modules and find the one with the matching name

uintptr_t GetModuleBaseAddress(DWORD procId, const wchar_t* modName)
{
    uintptr_t modBaseAddr = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId);
    if (hSnap != INVALID_HANDLE_VALUE)
    {
        MODULEENTRY32 modEntry;
        modEntry.dwSize = sizeof(modEntry);
        if (Module32First(hSnap, &modEntry))
        {
            do
            {
                if (!_wcsicmp(modEntry.szModule, modName))
                {
                    modBaseAddr = (uintptr_t)modEntry.modBaseAddr;
                    break;
                }
            } while (Module32Next(hSnap, &modEntry));
        }
    }
    CloseHandle(hSnap);
    return modBaseAddr;
}