Is this Module Pointer function alright?

You're right, i initially had it above the if statement, though then i thought about only declaring it when it's actually necessary ( if Module32First returns true ); i didn't think about it being out of scope for the return statement.

Code:

DWORD CMemory::Module( char* szModuleName )
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof( MODULEENTRY32 );

	bool bModuleFound = false;
  
	if ( Module32First( hModule, &mEntry ) )
	{		
		do 
    		{
      			if (!strcmp( mEntry.szModule, szModuleName ) && bModuleFound = true )
				break;
    		} while ( Module32Next( hModule, &mEntry ) );
  	}

  	CloseHandle( hModule );
  	return bModuleFound ? reinterpret_cast< DWORD >( mEntry.modBaseAddr ) : 0; 
}

Originally Posted by WasserEsser

Did you debug your code? If so, what did you find?

What do you mean with debug your code? I mean i obviously debugged it and it returned 0.

Originally Posted by derkrasseboy

What do you mean with debug your code? I mean i obviously debugged it and it returned 0.

Step through your code with the debugger and look where your debugger is returning / what modules Module32First / Next is traversing.

Originally Posted by WasserEsser

~snip~

Thanks, I've changed mine a little.

Code:

DWORD CMemory::Module(char* szModuleName)
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof(mEntry);

	if (Module32First(hModule, &mEntry))
	{
		do
		{
			if (!strcmp(mEntry.szModule, szModuleName))
			{
				CloseHandle(hModule);
				return (DWORD)mEntry.modBaseAddr;
			}
		} while (Module32Next(hModule, &mEntry));
	}

	return false;
}

Originally Posted by WasserEsser

Step through your code with the debugger and look where your debugger is returning / what modules Module32First / Next is traversing.

I haven't done that before, im gonna take a look into it tomorrow. Btw i am using c++/cli if that makes any difference.

Originally Posted by derkrasseboy

I haven't done that before, im gonna take a look into it tomorrow. Btw i am using c++/cli if that makes any difference.

Just use the functions posted in this thread already.

Originally Posted by Graaff

Thanks, I've changed mine a little.

Code:

DWORD CMemory::Module(char* szModuleName)
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof(mEntry);

	if (Module32First(hModule, &mEntry))
	{
		do
		{
			if (!strcmp(mEntry.szModule, szModuleName))
			{
				CloseHandle(hModule);
				return (DWORD)mEntry.modBaseAddr;
			}
		} while (Module32Next(hModule, &mEntry));
	}

	return false;
}

The problem about this implementation is a leaked handle if the module wasn't found since you're not closing the hModule handle before you return false / 0. That's why i changed it to the implementation above so i don't have 2 CloseHandle / return statements in the same function.

- - - Updated - - -

Originally Posted by derkrasseboy

I haven't done that before, im gonna take a look into it tomorrow. Btw i am using c++/cli if that makes any difference.

It shouldn't make any difference, but debugging the code accordingly should give more insight. You can see whether the handle is invalid because the ProcessID is wrong or what modules the function actually traverses / what information about the modules are getting saved into the buffer.

If i go with 2 CloseHandles like this:

Code:

DWORD Module(char* szModuleName)
	{
		HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessID);
		MODULEENTRY32 mEntry;
		mEntry.dwSize = sizeof(mEntry);

		if (Module32First(hModule, &mEntry))
		{
			do
			{
				if (!strcmp((char*)mEntry.szModule, szModuleName))
				{
					CloseHandle(hModule);
					return (DWORD)mEntry.modBaseAddr;
				}
			} while (Module32Next(hModule, &mEntry));
		}
		CloseHandle(hModule);
		return false;
	}

its still returning 0

and do i have to call the function like this:

Code:

if (__Client == 0x0) __Client = Module("client.dll");

or like this:

Code:

while (__Client == 0x0) __Client = Module("client.dll");

Originally Posted by WasserEsser

~snip~

That doesn't really matter since if modules haven't been found my program will exit on it's own.

Originally Posted by Graaff

That doesn't really matter since if modules haven't been found my program will exit on it's own.

It doesn't really matter, but it's bad practice to leak handles or memory. In theory, you don't need to free memory any memory, since the OS will take care of the allocated memory when the program exits, however, it's not good practice to leak memory or handles.

- - - Updated - - -

Originally Posted by derkrasseboy

If i go with 2 CloseHandles like this:

Code:

DWORD Module(char* szModuleName)
	{
		HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessID);
		MODULEENTRY32 mEntry;
		mEntry.dwSize = sizeof(mEntry);

		if (Module32First(hModule, &mEntry))
		{
			do
			{
				if (!strcmp((char*)mEntry.szModule, szModuleName))
				{
					CloseHandle(hModule);
					return (DWORD)mEntry.modBaseAddr;
				}
			} while (Module32Next(hModule, &mEntry));
		}
		CloseHandle(hModule);
		return false;
	}

its still returning 0

and do i have to call the function like this:

Code:

if (__Client == 0x0) __Client = Module("client.dll");

or like this:

Code:

while (__Client == 0x0) __Client = Module("client.dll");

It doesn't matter if you use an if statement or a while loop.

Use your debugger and see whats wrong. Also, after you returned 0, call GetLastError. I'm fairly certain it has something to do with your ProcessID.

You can use Process32First / Process32Next to traverse the process list and get the process id.

Originally Posted by WasserEsser

I know but it's the way it's designed and I don't want to change it. It's my first external which I haven't pasted and which is OOP-style based. It's cool to know I can do OOP-style programming. I found a strange feeling inside myself and when I look at my code it's just feels brilliant to me, but it's not probably.

Originally Posted by WasserEsser

I'm fairly certain it has something to do with your ProcessID.

You can use Process32First / Process32Next to traverse the process list and get the process id.

I doubt its the Process id because i just looked it up on the task manager and it was 1 the same as my result from my program and 2 i still got 0 as result from the module function. im just gonna do that debugger thing tomorrow, lets see if that helps.

Originally Posted by derkrasseboy

If it's not because of the ProcessID then only debugging can tell what's wrong.

Alright so I just debugged the code and it always says "Frame not in module" so im gonna look that up and try to fix it.

I found this code in another Source but im not sure if its really neccessary:

Code:

void runSetDebugPrivs()
	{
		HANDLE __HandleProcess = GetCurrentProcess(), __HandleToken;
		TOKEN_PRIVILEGES priv;
		LUID __LUID;
		OpenProcessToken(__HandleProcess, TOKEN_ADJUST_PRIVILEGES, &__HandleToken);
		LookupPrivilegeValue(0, "seDebugPrivilege", &__LUID);
		priv.PrivilegeCount = 1;
		priv.Privileges[0].Luid = __LUID;
		priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		AdjustTokenPrivileges(__HandleToken, false, &priv, 0, 0, 0);
		CloseHandle(__HandleToken);
		CloseHandle(__HandleProcess);
	}

Originally Posted by derkrasseboy

Alright so I just debugged the code and it always says "Frame not in module" so im gonna look that up and try to fix it.

I found this code in another Source but im not sure if its really neccessary:

Code:

void runSetDebugPrivs()
	{
		HANDLE __HandleProcess = GetCurrentProcess(), __HandleToken;
		TOKEN_PRIVILEGES priv;
		LUID __LUID;
		OpenProcessToken(__HandleProcess, TOKEN_ADJUST_PRIVILEGES, &__HandleToken);
		LookupPrivilegeValue(0, "seDebugPrivilege", &__LUID);
		priv.PrivilegeCount = 1;
		priv.Privileges[0].Luid = __LUID;
		priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		AdjustTokenPrivileges(__HandleToken, false, &priv, 0, 0, 0);
		CloseHandle(__HandleToken);
		CloseHandle(__HandleProcess);
	}

No it's not.

Is this Module Pointer function alright?

Post a Reply

Similar Threads

Tags for this Thread