Jump to content
Tuts 4 You

[.Net] Get ImageBase with Assembly class?


Recommended Posts

  • 3 weeks later...

You can P/Invoke the PSAPI.dll and use GetModuleInformation

public struct MODULEINFO
public IntPtr lpBaseOfDll;
public uint SizeOfImage;
public IntPtr EntryPoint;
} [DllImport("psapi.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool GetModuleInformation(IntPtr hProcess, IntPtr hModule, out MODULEINFO lpmodinfo, uint countBytes);

That's from Blackstorm's RE framework.

Link to comment
			foreach (ProcessModule mod in Process.GetCurrentProcess().Modules)
if (mod.ModuleName == "MyModule")

Standard .NET code. You just need to include "using System.Diagnostics".

Link to comment

The assembly wasn't loaded with LoadLibrary though so it isn't in the module list.

At this point I am probably gonna look at SOS.dll's dumpdomain function.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...