Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I’m experimenting with memory access in .NET. At the moment, I have a managed program that starts an unmanaged process and retrieves the BaseAddress of one of its loaded modules (a DLL). What I would like to do is somehow read the PE header of the loaded module so that I can later retrieve the addresses of its exports.
Unfortunately, I can’t find any good information about this. Any ideas?
This is a good starting point for the PE file format.
You can P/Invoke ReadProcessMemory from the base address you have to copy the headers into your process. You’ll need to parse the memory you read into the various PE headers. The first header is the IMAGE_DOS_HEADER, which will point you to the IMAGE_NT_HEADERS. You can then use the IMAGE_OPTIONAL_HEADER in the IMAGE_NT_HEADERS to find the location of the IMAGE_EXPORT_DIRECTORY in the binary.