Re: How to get imagebase after a DLL gets loaded
- From: "anton bassov" <soviet_bloke@xxxxxxxxxxx>
- Date: 1 Dec 2006 07:12:15 -0800
FWIW: Another thing that you can do _after_ the load is to call
VirtualQuery() passing it the address of some function in the DLL. That will
yield the DLL's base address among other bits of information.
This is absolutely unnecessary step, which involves a system call. What
is the point of making function calls, especially the ones that involve
user-to-kernel mode transition, at the time when you already have DLL's
base address???? Just for the fun of doing it?????
Anton Bassov
William DePalo [MVP VC++] wrote:
"Jack" <jl@xxxxxxxxxx> wrote in message
news:uUz3aYFFHHA.2268@xxxxxxxxxxxxxxxxxxxxxxx
I am wondering whether I should use
MapViewofFile to get the imagebase of a DLL
after loading that module using LoadLibrary?
I see that you have already gotten a few suggestions.
FWIW: Another thing that you can do _after_ the load is to call
VirtualQuery() passing it the address of some function in the DLL. That will
yield the DLL's base address among other bits of information.
Regards,
Will
.
- Follow-Ups:
- Re: How to get imagebase after a DLL gets loaded
- From: William DePalo [MVP VC++]
- Re: How to get imagebase after a DLL gets loaded
- References:
- How to get imagebase after a DLL gets loaded
- From: Jack
- Re: How to get imagebase after a DLL gets loaded
- From: William DePalo [MVP VC++]
- How to get imagebase after a DLL gets loaded
- Prev by Date: Re: Access kernel objects in different TS sessions?
- Next by Date: Re: Dealing with HANDLEs
- Previous by thread: Re: How to get imagebase after a DLL gets loaded
- Next by thread: Re: How to get imagebase after a DLL gets loaded
- Index(es):
Relevant Pages
|