Question

I’m writing a device driver that is loaded by a 3rd-party driver. I need a way to determine the name of the 3rd-party driver that is loading my device driver (for debug purposes).

For example, GetModuleFileName will provide me the name of the executable. I’d like instead to be able to get the DLL names.

The stack trace may be one of the following:

(a)

app0.exe
abc.dll <- detect "abc"
common.dll
my.dll

(b)

app1.exe
xyz.dll <- detect "xyz"
common.dll
my.dll

(c)

app2.exe
common.dll
my.dll

p.s. – I only need a method for C++ \ Windows

Answer 1

I assume you’ve got a process handle, or id of the process your my.dll is loaded in.

See an MSDN example at http://msdn.microsoft.com/en-us/library/ms686701(v=VS.85).aspx which will take a snapshot of a process and give all information.

The interesting method is at BOOL ListProcessModules( DWORD dwPID ):

MODULEENTRY32 has a field called szModule which contains the name of the module. See http://msdn.microsoft.com/en-us/library/ms684225(VS.85).aspx

All module entries can be retrieved from a process using CreateToolhelp32Snapshot, which requires the process id (th32ProcessID of PROCESSENTRY32).

Then you’ll iterate on all modules of the snapshot using Module32First and Module32Next. Also, do not forget to close the handle given by CreateToolhelp32Snapshot.

(Note: these methods are available from kernel32.dll)

This is called Module Walking, more on here: http://msdn.microsoft.com/en-us/library/ms684236(v=VS.85).aspx (described what is in this answer already)