How to read the header of a PE module loaded into memory?

Question

I am experimenting with memory access in .NET. At the moment, I have a managed program that starts an unmanaged process and retrieves BaseAddressone of its loaded modules (DLLs). What I would like to do is somehow read the PE header of the loaded module in order to subsequently get its export addresses.

Unfortunately, I can not find good information about this. Any ideas?

Answer 1

This is a good starting point for the PE file format.

P/Invoke ReadProcessMemory , . , , PE. - IMAGE_DOS_HEADER, IMAGE_NT_HEADERS. IMAGE_OPTIONAL_HEADER IMAGE_NT_HEADERS, IMAGE_EXPORT_DIRECTORY .