monoceres Posted September 12, 2008 Posted September 12, 2008 (edited) Hi all! I don't think anyone has done this before so here it goes: This returns an array of all the modules (dll files) that are loaded into a process. For some reason the array also contains a great deal of copies of the process's full path. expandcollapse popup#Include <WinAPI.au3> ; #FUNCTION#;=============================================================================== ; ; Name...........: _ProcessGetLoadedModules ; Description ...: Returns an array containing the full path of the loaded modules ; Syntax.........: _ProcessGetLoadedModules($iPID) ; Parameters ....: ; Return values .: Success - An array with all the paths ; : Failure - -1 and @error=1 if the specified process couldn't be opened. ; Author ........: Andreas Karlsson (monoceres) & ProgAndy ; Modified.......: ; Remarks .......: ; Related .......: ; Link ..........; ; Example .......; No ; ;;========================================================================================== Func _ProcessGetLoadedModules($iPID) Local Const $PROCESS_QUERY_INFORMATION=0x0400 Local Const $PROCESS_VM_READ=0x0010 Local $aCall, $hPsapi=DllOpen("Psapi.dll") Local $hProcess, $tModulesStruct $tModulesStruct=DllStructCreate("hwnd [200]") Local $SIZEOFHWND = DllStructGetSize($tModulesStruct)/200 $hProcess=_WinAPI_OpenProcess(BitOR($PROCESS_QUERY_INFORMATION,$PROCESS_VM_READ),False,$iPID) If Not $hProcess Then Return SetError(1,0,-1) $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",DllStructGetSize($tModulesStruct),"dword*","") If $aCall[4]>DllStructGetSize($tModulesStruct) Then $tModulesStruct=DllStructCreate("hwnd ["&$aCall[4]/$SIZEOFHWND&"]") $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",$aCall[4],"dword*","") EndIf Local $aReturn[$aCall[4]/$SIZEOFHWND] For $i=0 To Ubound($aReturn)-1 $aCall=DllCall($hPsapi,"dword","GetModuleFileNameExW","ptr",$hProcess,"ptr",DllStructGetData($tModulesStruct,1,$i+1),"wstr","","dword",65536) $aReturn[$i]=$aCall[3] Next _WinAPI_CloseHandle($hProcess) DllClose($hPsapi) Return $aReturn EndFunc Enjoy! Edited December 14, 2009 by monoceres Broken link? PM me and I'll send you the file!
monoceres Posted September 12, 2008 Author Posted September 12, 2008 This is like DOS command TASKLIST /M? Yeah, I guess so. This should be faster though Broken link? PM me and I'll send you the file!
Andreik Posted September 12, 2008 Posted September 12, 2008 (edited) I don'y know if is a bug or is normal but at one time appeared that process as module several times. Try this to see what I want to say. expandcollapse popup#Include <WinAPI.au3> #include <Array.au3> ; #FUNCTION#;=============================================================================== ; ; Name...........: _ProcessGetLoadedModules ; Description ...: Returns an array containing the full path of the loaded modules ; Syntax.........: _ProcessGetLoadedModules($iPID) ; Parameters ....: ; Return values .: Success - An array with all the paths ; : Failure - -1 and @error=1 if the specified process couldn't be opened. ; Author ........: Andreas Karlsson (monoceres) ; Modified.......: ; Remarks .......: ; Related .......: ; Link ..........; ; Example .......; No ; ;;========================================================================================== Func _ProcessGetLoadedModules($iPID) Local Const $PROCESS_QUERY_INFORMATION=0x0400 Local Const $PROCESS_VM_READ=0x0010 Local $aCall, $hPsapi=DllOpen("Psapi.dll") Local $hProcess, $tModulesStruct $tModulesStruct=DllStructCreate("int [1000]") $hProcess=_WinAPI_OpenProcess(BitOR($PROCESS_QUERY_INFORMATION,$PROCESS_VM_READ),False,$iPID) If Not $hProcess Then Return SetError(1,0,-1) $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",1000,"dword*","") If $aCall[4]>1000 Then $tModulesStruct=DllStructCreate("int ["&$aCall[4]&"]") $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",$aCall[4],"dword*","") EndIf Local $aReturn[$aCall[4]] For $i=0 To Ubound($aReturn)-1 $aCall=DllCall($hPsapi,"dword","GetModuleFileNameExW","ptr",$hProcess,"int",DllStructGetData($tModulesStruct,1,$i+1),"wstr","","dword",65536) $aReturn[$i]=$aCall[3] Next _WinAPI_CloseHandle($hProcess) DllClose($hPsapi) Return $aReturn EndFunc $LIST = ProcessList() $MODULES = _ProcessGetLoadedModules($LIST[5][1]) _ArrayDisplay($MODULES,$LIST[5][0]) Edited September 12, 2008 by Andreik
monoceres Posted September 12, 2008 Author Posted September 12, 2008 I don'y know if is a bug or is normal but at one time appeared that process as module several times.I mentioned that in my original post Broken link? PM me and I'll send you the file!
Andreik Posted September 12, 2008 Posted September 12, 2008 I mentioned that in my original post Sorry. >_<
ProgAndy Posted September 12, 2008 Posted September 12, 2008 I have the BugFix. EnumProcessModules returns the BYTES needed, not the count of Module Hanldes. So you have to divide the Bytes through SIZEOFHWND expandcollapse popup#Include <WinAPI.au3> #include <Array.au3> ; #FUNCTION#;=============================================================================== ; ; Name...........: _ProcessGetLoadedModules ; Description ...: Returns an array containing the full path of the loaded modules ; Syntax.........: _ProcessGetLoadedModules($iPID) ; Parameters ....: ; Return values .: Success - An array with all the paths ; : Failure - -1 and @error=1 if the specified process couldn't be opened. ; Author ........: Andreas Karlsson (monoceres) ; Modified.......: ; Remarks .......: ; Related .......: ; Link ..........; ; Example .......; No ; ;;========================================================================================== Func _ProcessGetLoadedModules($iPID) Local Const $PROCESS_QUERY_INFORMATION=0x0400 Local Const $PROCESS_VM_READ=0x0010 Local $aCall, $hPsapi=DllOpen("Psapi.dll") Local $hProcess, $tModulesStruct $tModulesStruct=DllStructCreate("hwnd [200]") Local $SIZEOFHWND = DllStructGetSize($tModulesStruct)/200 $hProcess=_WinAPI_OpenProcess(BitOR($PROCESS_QUERY_INFORMATION,$PROCESS_VM_READ),False,$iPID) If Not $hProcess Then Return SetError(1,0,-1) $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",DllStructGetSize($tModulesStruct),"dword*","") If $aCall[4]>DllStructGetSize($tModulesStruct) Then $tModulesStruct=DllStructCreate("hwnd ["&$aCall[4]/$SIZEOFHWND&"]") $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",$aCall[4],"dword*","") EndIf Local $aReturn[$aCall[4]/$SIZEOFHWND] For $i=0 To Ubound($aReturn)-1 $aCall=DllCall($hPsapi,"dword","GetModuleFileNameExW","ptr",$hProcess,"int",DllStructGetData($tModulesStruct,1,$i+1),"wstr","","dword",65536) $aReturn[$i]=$aCall[3] Next _WinAPI_CloseHandle($hProcess) DllClose($hPsapi) Return $aReturn EndFunc $LIST = ProcessList() $MODULES = _ProcessGetLoadedModules($LIST[5][1]) _ArrayDisplay($MODULES,$LIST[5][0]) *GERMAN* [note: you are not allowed to remove author / modified info from my UDFs]My UDFs:[_SetImageBinaryToCtrl] [_TaskDialog] [AutoItObject] [Animated GIF (GDI+)] [ClipPut for Image] [FreeImage] [GDI32 UDFs] [GDIPlus Progressbar] [Hotkey-Selector] [Multiline Inputbox] [MySQL without ODBC] [RichEdit UDFs] [SpeechAPI Example] [WinHTTP]UDFs included in AutoIt: FTP_Ex (as FTPEx), _WinAPI_SetLayeredWindowAttributes
monoceres Posted September 12, 2008 Author Posted September 12, 2008 I have the BugFix. EnumProcessModules returns the BYTES needed, not the count of Module Hanldes. So you have to divide the Bytes through SIZEOFHWND Of course, how stupid of me Thanks for fixing it (updating my first post and adding you to authors) >_< Broken link? PM me and I'll send you the file!
netegg Posted December 14, 2009 Posted December 14, 2009 Hi，does it not work in windows 7? Why can't I get anything in the win7 pro?
AdmiralAlkex Posted December 14, 2009 Posted December 14, 2009 Hi，does it not work in windows 7? Why can't I get anything in the win7 pro?It works for me under Win 7 RC (x64). It gives wrong results for x64 but running under x86 gives the expected results.You must be using it wrong, please show a small (but runnable) reproducer of your problem. .Some of my scripts: ShiftER, Codec-Control, Resolution switcher for HTC ShiftSome of my UDFs: SDL UDF, SetDefaultDllDirectories, Converting GDI+ Bitmap/Image to SDL Surface
ProgAndy Posted December 14, 2009 Posted December 14, 2009 It works for me under Win 7 RC (x64). It gives wrong results for x64 but running under x86 gives the expected results. You must be using it wrong, please show a small (but runnable) reproducer of your problem. The x64-error could come from the GetModuleFileNameExW. There is "int" as type instead of "ptr", so try and change it $aCall=DllCall($hPsapi,"dword","GetModuleFileNameExW","ptr",$hProcess,"ptr",DllStructGetData($tModulesStruct,1,$i+1),"wstr","","dword",65536) *GERMAN* [note: you are not allowed to remove author / modified info from my UDFs]My UDFs:[_SetImageBinaryToCtrl] [_TaskDialog] [AutoItObject] [Animated GIF (GDI+)] [ClipPut for Image] [FreeImage] [GDI32 UDFs] [GDIPlus Progressbar] [Hotkey-Selector] [Multiline Inputbox] [MySQL without ODBC] [RichEdit UDFs] [SpeechAPI Example] [WinHTTP]UDFs included in AutoIt: FTP_Ex (as FTPEx), _WinAPI_SetLayeredWindowAttributes
AdmiralAlkex Posted December 14, 2009 Posted December 14, 2009 The x64-error could come from the GetModuleFileNameExW. There is "int" as type instead of "ptr", so try and change it $aCall=DllCall($hPsapi,"dword","GetModuleFileNameExW","ptr",$hProcess,"ptr",DllStructGetData($tModulesStruct,1,$i+1),"wstr","","dword",65536) Works perfect now. .Some of my scripts: ShiftER, Codec-Control, Resolution switcher for HTC ShiftSome of my UDFs: SDL UDF, SetDefaultDllDirectories, Converting GDI+ Bitmap/Image to SDL Surface
trancexx Posted December 14, 2009 Posted December 14, 2009 (edited) The code seems not wrong for no mistake show in the console(win7 x86). So I can't know how to deal with it.And with your opnion(instead of "ptr" with "int"), that is the same.Second line of what you quoted was: You must be using it wrong, please show a small (but runnable) reproducer of your problem.You saw that? Edited December 14, 2009 by trancexx ♡♡♡ . eMyvnE
monoceres Posted December 14, 2009 Author Posted December 14, 2009 Updated with ProgAndys fix. Broken link? PM me and I'll send you the file!
Factfinder Posted September 1, 2013 Posted September 1, 2013 (edited) Nice script. I used it on Win 7 (x64) and got an error: Local $aReturn[$aCall[4]/$SIZEOFHWND] Local $aReturn[^ ERROR Error: Array variable subscript badly formatted. Added a BugFix before the line: If Not $aCall[4] Then Return SetError(1,0,-1) The script worked. If I run the script or compile it to x86, it works (on x64) properly. If I compile the script to x64, it will only returns the x64 modules. The x32 modules will not be ruturned. What could be the reason? Thanks in advance. Edited September 2, 2013 by Factfinder
Factfinder Posted September 1, 2013 Posted September 1, 2013 (edited) It seems that compiling to x86 version only returns the x86 modules. When compiled with to x64 version only returns the x64 modules. So the script needs modification to cover both the versions. Edited September 1, 2013 by Factfinder
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now