Question

I want to enumerate all the loaded segments of a module given a module handle. Are there any API functions I can call to do this? Or is the only way reading the PE header and working out which segments are loaded and which are not?

If I have to end up reading the PE header, could someone help describe the structure of the header or link me to a guide and also give steps to enumerate the segments? I know how to do this with an ELF header but not PE.

Answer 1

Read these MSDN articles by Matt Pietrek and follow their links:

• Peering Inside the PE: A Tour of the Win32 Portable Executable File Format
• An In-Depth Look into the Win32 Portable Executable File Format