asked on

Get import table of a running process

Hello,

I know the handle of an running process ( hProcess := OpenProcess(AccessRights, FALSE, PID); ) and I want to know which DLL files it have loaded. I do not want to know which DLL is in the process space of this running process (injected DLLs can be also in the process space, but injected DLLs are not loaded from a process, because injected DLLs are injected to the process.)
That means I can not use EnumProcessModules or Module32First, because these functions also enumerate the injected DLLs.
A solution could be to get the import table of this running process and look for the DLLs which the process is using. How can I do this? The .exe file of the running process is compressed, so I have to get the import table from the process in memory - not from the .exe file.
The solution should work on Windows NT (Win9x would be fine).

Thanky you for your answer for this difficult question
Ben

BTW: I think, here you can found something similar: Look for "function GetProcAddress32" at http://www.delphipages.com/news/detaildocs.cfm?ID=17
or look for "FindCallerModuleHandle" on http://groups.google.com

ASKER CERTIFIED SOLUTION

GloomyFriar

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

GloomyFriar

"import table" may contain not all DLLs. How about DLLs loaded by LoadLibrary?

GloomyFriar

Could you tell more detailed what do you want to make?

bengore

ASKER

GloomyFriar, thank you for your comments.
How about DLLs linked static (not loaded by LoadLibrary). Is there a way to get this DLLs via "import table"?

bengore

ASKER

More details? I have a DLL file. I want to know if a processes (somethimes with comressed .exe files) needs this DLL file (static linked).

SOLUTION

DaFox

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

bengore

ASKER

DaFox, I think ImgWalk.dll use EnumProcessModules or Module32First and enumerate also injected DLLs.

DaFox

>> I think ImgWalk.dll use EnumProcessModules or Module32First

nope, it uses VirtualQuery that fills the MEMORY_BASIC_INFORMATION structure.

>> injected DLLs

that's right, and therefore it also gets dynamically loaded dlls.

Markus

GloomyFriar

>How about DLLs linked static (not loaded by LoadLibrary). Is there a way to get this DLLs via "import table"?
Yes of course.
You just need to open the exe file and read its PE header.

GloomyFriar

Something like that (it work with running exe, but you can do the same with a file):

function FindUsablePage(hProcess: THANDLE; PProcessBase: pointer): pointer;
var peHdrOffset: DWORD;
cBytesMoved: DWORD;
ntHdr: IMAGE_NT_HEADERS;
pSection: ^IMAGE_SECTION_HEADER;
i: ULONG;
tmpPtr: PBYTE;
section: IMAGE_SECTION_HEADER;
SecName: string;
begin
Result := nil;

// Read in the offset of the PE header within the debuggee
tmpPtr := PBYTE(PProcessBase);
inc(tmpPtr, $3C);
if ReadProcessMemory(ProcessInformation.hProcess,
tmpPtr,
@peHdrOffset,
sizeof(peHdrOffset),
cBytesMoved) = False then Exit;

// Read in the IMAGE_NT_HEADERS.OptionalHeader.BaseOfCode field
tmpPtr := PBYTE(PProcessBase);
inc(tmpPtr, peHdrOffset);
if ReadProcessMemory(ProcessInformation.hProcess,
tmpPtr, @ntHdr, sizeof(ntHdr),
cBytesMoved) = False then Exit;

tmpPtr := PBYTE(PProcessBase);
inc(tmpPtr, peHdrOffset + 4 + sizeof(ntHdr.FileHeader) +
ntHdr.FileHeader.SizeOfOptionalHeader);
pSection := pointer(tmpPtr);//(PIMAGE_SECTION_HEADER)

for i:=0 to Pred(ntHdr.FileHeader.NumberOfSections) do begin
//{IMAGE_SECTION_HEADER section;
if ReadProcessMemory(ProcessInformation.hProcess,
pSection, @section, sizeof(section),
cBytesMoved) = False then Exit;
// OutputDebugString( "trying section:
// OutputDebugString( section.Name )'
// OutputDebugString( "\r\n" )'

SecName := StrPas(@section.Name[0]);
// If it's writeable, and not the .idata section, we'll go with it
if(((section.Characteristics and IMAGE_SCN_MEM_WRITE) <> 0) and
(StrLComp(@section.Name[0], '.idata', 6) <> 0)) then begin
OutputDebugString(PChar('using section.' + StrPas(@section.Name[0]) + #10 + #13));
Result := pointer(DWORD(PProcessBase) + section.VirtualAddress);
//Exit;
end;
Inc(pSection); // Not this section. Advance to next section.
end;
end;

GloomyFriar

You can read about PE format here:

http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx

GloomyFriar

Here is the code that read exports, but it's rather easy to make it read imports.
If any problems I'll can help tomorrow.

https://www.experts-exchange.com/questions/20079575/functions-in-DLL.html

bengore

ASKER

Hi GloomyFriar, thank you for your FindUsablePage source and the other links. I will check it.

> You just need to open the exe file and read its PE header.
This is not usefull, if the .exe file is compressed.

GloomyFriar

>This is not usefull, if the .exe file is compressed.
Which compressor is used?
Are you sure that import sections is changed by the compressor?