get x64 process module base address from x86 app

Question

How would one get the base address of a module in a x64 process from a x86(32bit) app. i have no problem getting the process id with NtQuerySystemInformation but CreateToolhelp32Snapshot and EnumProcesses both fail to get the x64 process modules, are there any other ways to do this like any undocumented functions im missing?

Answer 1

You can achieve this by parsing PEB structure. It's undocumented but it's not changing between systems: http://www.nirsoft.net/kernel_struct/vista/PEB.html

Interesting part for you is PEB->Ldr->InLoadOrderModuleList.