Solved

Get import table of a running process

Posted on 2003-11-11
16
1,004 Views
Last Modified: 2012-06-27
Hello,

I know the handle of an running process (  hProcess := OpenProcess(AccessRights, FALSE, PID); ) and I want to know which DLL files it have loaded. I do not want to know which DLL is in the process space of this running process (injected DLLs can be also in the process space, but injected DLLs are not loaded from a process, because injected DLLs are injected to the process.)
That means I can not use EnumProcessModules or Module32First, because these functions also enumerate the injected DLLs.
A solution could be to get the import table of this running process and look for the DLLs which the process is using. How can I do this? The .exe file of the running process is compressed, so I have to get the import table from the process in memory - not from the .exe file.
The solution should work on Windows NT (Win9x would be fine).

Thanky you for your answer for this difficult question
Ben

BTW: I think, here you can found something similar: Look for "function GetProcAddress32" at http://www.delphipages.com/news/detaildocs.cfm?ID=17
or look for "FindCallerModuleHandle" on http://groups.google.com

0
Comment
Question by:bengore
  • 8
  • 4
  • 2
16 Comments
 
LVL 6

Accepted Solution

by:
GloomyFriar earned 250 total points
ID: 9721872
In a "running process" there is no differences between "loaded" and "injected" DLLs.
0
 
LVL 6

Expert Comment

by:GloomyFriar
ID: 9721884
"import table" may contain not all DLLs. How about DLLs loaded by LoadLibrary?
0
 
LVL 6

Expert Comment

by:GloomyFriar
ID: 9721901
Could you tell more detailed what do you want to make?
0
3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

 

Author Comment

by:bengore
ID: 9721915
GloomyFriar, thank you for your comments.
How about DLLs linked static (not loaded by LoadLibrary). Is there a way to get this DLLs via "import table"?
0
 

Author Comment

by:bengore
ID: 9721974
More details? I have a DLL file. I want to know if a processes (somethimes with comressed .exe files) needs this DLL file (static linked).
0
 
LVL 6

Assisted Solution

by:DaFox
DaFox earned 250 total points
ID: 9722777
In Jeffrey Richter's book there is a DLL called ImgWalk.dll (lists all DLLs used by a process).

Markus
0
 

Author Comment

by:bengore
ID: 9723271
DaFox, I think ImgWalk.dll use EnumProcessModules or Module32First and enumerate also injected DLLs.
0
 
LVL 6

Expert Comment

by:DaFox
ID: 9723316
>> I think ImgWalk.dll use EnumProcessModules or Module32First

nope, it uses VirtualQuery that fills the MEMORY_BASIC_INFORMATION structure.

>> injected DLLs

that's right, and therefore it also gets dynamically loaded dlls.

Markus
0
 
LVL 6

Expert Comment

by:GloomyFriar
ID: 9724609
>How about DLLs linked static (not loaded by LoadLibrary). Is there a way to get this DLLs via "import table"?
Yes of course.
You just need to open the exe file and read its PE header.
0
 
LVL 6

Expert Comment

by:GloomyFriar
ID: 9724711
Something like that (it work with running exe, but you can do the same with a file):

function FindUsablePage(hProcess: THANDLE; PProcessBase: pointer): pointer;
var peHdrOffset: DWORD;
    cBytesMoved: DWORD;
    ntHdr: IMAGE_NT_HEADERS;
    pSection: ^IMAGE_SECTION_HEADER;
    i: ULONG;
    tmpPtr: PBYTE;
    section: IMAGE_SECTION_HEADER;
    SecName: string;
begin
   Result := nil;

   // Read in the offset of the PE header within the debuggee
   tmpPtr := PBYTE(PProcessBase);
   inc(tmpPtr, $3C);
   if ReadProcessMemory(ProcessInformation.hProcess,
                        tmpPtr,
                        @peHdrOffset,
                        sizeof(peHdrOffset),
                        cBytesMoved) = False then Exit;

   // Read in the IMAGE_NT_HEADERS.OptionalHeader.BaseOfCode field
   tmpPtr := PBYTE(PProcessBase);
   inc(tmpPtr, peHdrOffset);
   if ReadProcessMemory(ProcessInformation.hProcess,
                        tmpPtr, @ntHdr, sizeof(ntHdr),
                        cBytesMoved) = False then Exit;

   tmpPtr := PBYTE(PProcessBase);
   inc(tmpPtr, peHdrOffset + 4 + sizeof(ntHdr.FileHeader) +
       ntHdr.FileHeader.SizeOfOptionalHeader);
   pSection := pointer(tmpPtr);//(PIMAGE_SECTION_HEADER)

  for i:=0 to Pred(ntHdr.FileHeader.NumberOfSections) do begin
     //{IMAGE_SECTION_HEADER section;
     if ReadProcessMemory(ProcessInformation.hProcess,
                          pSection, @section, sizeof(section),
                          cBytesMoved) = False then Exit;
     // OutputDebugString( "trying section:
     // OutputDebugString( section.Name )'
     // OutputDebugString( "\r\n" )'

     SecName := StrPas(@section.Name[0]);
     // If it's writeable, and not the .idata section, we'll go with it
     if(((section.Characteristics and IMAGE_SCN_MEM_WRITE) <> 0) and
        (StrLComp(@section.Name[0], '.idata', 6) <> 0)) then begin
         OutputDebugString(PChar('using section.' + StrPas(@section.Name[0]) + #10 + #13));
        Result := pointer(DWORD(PProcessBase) + section.VirtualAddress);
        //Exit;
     end;
     Inc(pSection); // Not this section. Advance to next section.
  end;
end;
0
 
LVL 6

Expert Comment

by:GloomyFriar
ID: 9724775
0
 
LVL 6

Expert Comment

by:GloomyFriar
ID: 9724991
Here is the code that read exports, but it's rather easy to make it read imports.
If any problems I'll can help tomorrow.

http://www.experts-exchange.com/Programming/Programming_Languages/Delphi/Q_20079575.html
0
 

Author Comment

by:bengore
ID: 9729404
Hi GloomyFriar, thank you for your FindUsablePage source and the other links. I will check it.

> You just need to open the exe file and read its PE header.
This is not usefull, if the .exe file is compressed.
0
 
LVL 6

Expert Comment

by:GloomyFriar
ID: 9733230
>This is not usefull, if the .exe file is compressed.
Which compressor is used?
Are you sure that import sections is changed by the compressor?
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Objective: - This article will help user in how to convert their numeric value become words. How to use 1. You can copy this code in your Unit as function 2. than you can perform your function by type this code The Code   (CODE) The Im…
Introduction I have seen many questions in this Delphi topic area where queries in threads are needed or suggested. I know bumped into a similar need. This article will address some of the concepts when dealing with a multithreaded delphi database…
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question