Geek asks and answers

Dynamic Link Library Address Range under Windows

I have a working program that loads plugins from LoadLibrary.

New requirement: at some point in the code, a pointer is assigned to me, and I need to check whether this pointer points to the code or the static data of the plugin.

bool is_pointer_into_plugin(void *p, HMODULE h);

Equivalently, I need to get a plugin that points to a pointer, if any. I also need to know if the pointer points to the main program code or static data (and ideally distinguish between read-only and read-write areas).

HMODULE plugin_containing_pointer(void *p);

Equivalently, I need to be able to get the size (address and size) on which the plugin is displayed. I also need this information for the main program.

How can I implement is_pointer_into_plugin, or plugin_containing_pointer, or something equivalent?

I can change the call LoadLibraryif necessary. The search should be as fast as possible, the load time code should not be fast. Running plugins in separate processes and sharing data through shared memory is not an option. The program should work on Windows XP and higher (and Linux, but another question ).

I need more or less what the Sysinternals service reports listdlls, so I tried to figure out how it is implemented. I saw a suggestion for using to get a structure that refers to . It looks promising, but: NtQueryInformationProcess PEB LDR_DATA_TABLE_ENTRY

  • I see DllBasethat looks like the starting address of each DLL (is this?), But not the size.
  • NtQueryInformationProcess , , , .
  • PEB BeingDebugged SessionId, - ReservedN - .

, , , ?

+5
1

GetModuleHandleEx GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS , . , , . . , ?

+4

More articles:


All Articles