Finding the memory address of a loaded DLL in a process in C ++

Question

I have a working process that uses "Test.dll". I would like to know the exact memory location at the beginning of Test.dll in memory, but it seems it cannot.

My main problem is that I need to write the offset from this dll, but I cannot enter Test.dll + some offset exactly when I use Read / WriteProcessMemory.

Any help would be greatly appreciated.

Answer 1

Ok, so one way to do this is to use the value returned by GetModuleHandle() . Yes, it returns HANDLE , but you can apply it to the corresponding type of pointer. Compare with the range of module addresses in the "Modules" window of Visual Studio, and you will see that this is the same as the initial value for the range.

The best way to do this is to use GetModuleInformation () . The first field of the MODULEINFO structure you pass in will contain the base address of the DLL.

Although according to the MODULEINFO documentation:

The module load address is the same as the HMODULE value.

So, I think using HMODULE and casting is fine. Whatever you do, I think.

If you want information for a remote process, use EnumProcessModules () .