Hi, Can someone provide MODULEINFO structure in MASM64?
invoke GetModuleInformation, hProcess, qword ptr [rax], addr modInfo, sizeof MODULEINFO

I realized that MODULEINFO structure is not defined anywhere!

I found the way I have define that struct in MASM64:
MODULEINFO STRUCT
lpBaseOfDll DQ ? ; Base address of module
SizeOfImage DQ ? ; Size of the module in bytes
EntryPoint DQ ? ; Entry point of the module
MODULEINFO ENDS

GetModuleInformation return proper value.

typedef struct _MODULEINFO {

LPVOID lpBaseOfDll; //4 on x32, 8 on x64

DWORD SizeOfImage; //4 on both

LPVOID EntryPoint; //4 on x32, 8 on x64

} MODULEINFO, *LPMODULEINFO;

2 hours ago, BfoX said:

typedef struct _MODULEINFO {

LPVOID lpBaseOfDll; //4 on x32, 8 on x64

DWORD SizeOfImage; //4 on both

LPVOID EntryPoint; //4 on x32, 8 on x64

} MODULEINFO, *LPMODULEINFO;

This is what I thought at first; anyway declarated like this doesn't works;
SizeOfImage has to be also a qword.

You missed alignment of struct members, I guess.

...

Edited March 3Mar 3 by Stingered

11 hours ago, CodeExplorer said:

Hi, Can someone provide MODULEINFO structure in MASM64?
invoke GetModuleInformation, hProcess, qword ptr [rax], addr modInfo, sizeof MODULEINFO

I realized that MODULEINFO structure is not defined anywhere!

Are you using hutch's MASM64 SDK? Yes unfortunately it does not have that struct.