Modules loaded by a exe

thanks for the info man!

Sorry, but the method above is suxx. Too easy to fool. If you want to create sth really useful, you stick to NT+ architecture. Go search for "PEB_LDR_DATA". This is what you need.

[Shub-Nigurrath]

humm..that undocumented things are supported through different OSs (XP,2003)?
It depends on which level you want to be sure of this..the infos obtained are almost the same, isn't it?

PEB is present starting from NT+.
The exact implementation of the structure is different. You can extract it from PDB-files using pdb-dump by de Quency.

[JMI]

Here's a little searching project for you all. The de Quincy article is available on "Searchlore" and his utility is available on "Sourceforge."

Regards,

As opposed in a concurrent thread (initial register values), the PEB can easily be retrieved with the following (VC) C++ code:
void *PEB = NULL;
__asm
{
mov eax,fs:[0x30]
mov PEB,eax
}
On windows 2000 it is constantly 0x7ffdf000
regards, PHaX

My dear JMI, no need to go to Sourceforge
http://wasm.ru/tools/21/pdbdump.zip
+ DIA SDK:
http://wasm.ru/tools/4/dia.zip