Modules loaded by EXE

Just another tool that lists the modules that are loaded by the processes running on your machine. ATM it's only a basic tool that lists modules for those process which it is able to grab a handle, rest of which is ignored.

; #################################### .386 .model flat, stdcall option casemap :none ; case sensitive ; #################################### include \masm32\include\windows.inc include \masm32\include\user32.inc include \masm32\include\kernel32.inc include \masm32\include\masm32.inc include \masm32\include\Psapi.inc includelib \masm32\lib\user32.lib includelib \masm32\lib\kernel32.lib includelib \masm32\lib\masm32.lib includelib \masm32\lib\Psapi.lib ; ##################################### .data pgmheader db "Handle Alternative",0DH,0AH, 0 newline db " ",0DH,0AH, 0 separator db "%%%%%%%%%%%%%",0DH,0AH, 0 .data? hWnd dd ? lpcbNeeded dd ? lphModule dd 256 DUP(?) pProcessIds dd 256 DUP(?) lpFileName db 256 DUP (?) count dd ? pBytesReturned dd ? .code start: invoke StdOut, ADDR pgmheader invoke EnumProcesses, OFFSET pProcessIds, SIZEOF pProcessIds, OFFSET pBytesReturned mov edi, OFFSET pProcessIds add edi, DWORD _outerloop: cmp DWORD PTR [edi], NULL jz _Exit invoke OpenProcess, PROCESS_ALL_ACCESS, FALSE, [edi] mov hWnd, eax cmp hWnd, NULL jz _interloop invoke StdOut, ADDR separator invoke EnumProcessModules, hWnd , OFFSET lphModule, SIZEOF lphModule, OFFSET lpcbNeeded mov esi, OFFSET lphModule _innerloop: cmp DWORD PTR [esi], NULL jz _interloop invoke GetModuleFileNameEx, hWnd, [esi], ADDR lpFileName, SIZEOF lpFileName invoke StdOut, ADDR lpFileName invoke StdOut, ADDR newline add esi, DWORD jmp _innerloop _interloop: invoke RtlZeroMemory, OFFSET lphModule, SIZEOF lphModule add edi, DWORD jmp _outerloop _Exit: invoke ExitProcess, NULL end start

How do we achieve them? We first get the list of processes running on the machine using EnumProcesses. After which we open each of the processes using OpenProcess supplying the returned process ids by EnumProcesses. That process is put in a separate outer loop. In the inner loop we fetch the handle of the process and use EnumProcessModules to get the handles for the modules that are loaded by the process. Once that is done we use GetModuleFileNameEx to get the complete path of the loaded module. In all the process the first module handle returned by the EnumProcessModule will be that of the process itself.

Let me know how this goes... Link them like,

link /SUBSYTEM:CONSOLE programname.obj

PS:There is absolutely no error checking that I have included in the code. This post is just to give an overview of how modules can be obtained for all the running processes (exceptions are those for which I wasn't able to get an handle)

binaryhax0r