Jump to content
Tuts 4 You

Quick Noob Question


Recommended Posts

Hello all,

I need to get some quick dirty patching done. Which APIs let you retrieve the Imagebase of a module in another process? I'm looking to get the ImageBase of a DLL loading into another process. Been googling a bit but cant seem to find it and its slipped my memory :P



Edited by rendari
Link to comment

tlhelp32: http://msdn.microsoft.com/en-us/library/ms686832%28VS.85%29.aspx






psapi: http://msdn.microsoft.com/en-us/library/ms684894%28VS.85%29.aspx



Both can achieve the same thing, up to you which you wish to use. There are a bunch of examples around the net using both of these libraries. If you need help just ask. :)

Link to comment

You also can look at PEB.ImageBaseAddress by ReadProcessMemory

but this way is not documented by ms ^_____^ and may be not compatible with new OSes

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...