Find dll address in memory

I just started programming at a low level (read / write to memory) and ran into a problem that I can not find the answer to.

Some of the information I want to read has an address related to a DLL loaded into e, g memory, on mydll.dll + 0x01234567. im problem is that the dll is moving in memory but the offset remains unchanged. Is there anyway to find out the location of this dll in memory.

I am currently trying to do this preferably in C #, but I would be grateful for the help in the highest level languages.

+3
source share
2 answers

, , ( , , DLL , ).

, , :

i Process

String appToHookTo = "applicationthatloadedthedll";
Process[] foundProcesses = Process.GetProcessesByName(appToHookTo)
ProcessModuleCollection modules = foundProcesses[0].Modules;
ProcessModule dllBaseAdressIWant = null;
foreach (ProcessModule i in modules) {
if (i.ModuleName == "nameofdlliwantbaseadressof") {
                    dllBaseAdressIWant = i;
                }
        }

, dllbaseAdressIWant.BaseAddress, .

,

+2

Win32 GetModuleHandle GetModuleInformation. , , .

, API P/Invoke.

+1
source

Source: https://habr.com/ru/post/1699223/


All Articles