state = ZwQueryInformationProcess(NtCurrentProcess(), ProcessBasicInformation, &process_base_info, sizeof(PROCESS_BASIC_INFORMATION), &Ret_Lenght);
state = PsLookupProcessByProcessId(PsGetCurrentProcessId(), &eprocess);
if (NT_SUCCESS(state))
{
KeAttachProcess(eprocess);
__try
{
PPEB_LDR_DATA lpLDRData = (PPEB_LDR_DATA)*(PULONG)((ULONG)(process_base_info.PebBaseAddress) + 0x18);
PLIST_ENTRY pHead = &lpLDRData->InLoadOrderModuleList;
PLIST_ENTRY pTemp = NULL;
PLDR_DATA_TABLE_ENTRY pFind = NULL;
pTemp = pHead->Flink;
while (pTemp&&pTemp != pHead)
{
pFind = CONTAINING_RECORD(pTemp, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);
dprintf("[MODULE]:%ws\n", pFind->BaseDllName.Buffer);
pTemp = pTemp->Flink;
}
}
__except (1)
{
dprintf("[Error]\n");
}
KeDetachProcess();
}
