学习VLD2.0代码,看到如下函数:
HMODULE GetCallingModule( UINT_PTR pCaller )
{
HMODULE hModule = NULL;
MEMORY_BASIC_INFORMATION mbi;
if ( VirtualQuery((LPCVOID)pCaller, &mbi, sizeof(MEMORY_BASIC_INFORMATION)) == sizeof(MEMORY_BASIC_INFORMATION) )
{
// the allocation base is the beginning of a PE file
hModule = (HMODULE) mbi.AllocationBase;
}
return hModule;
}
入参是函数地址或eip/rip,可以得到其所在的模块句柄。
时间: 2024-10-09 07:15:23