c++ - Get filename mapped into memory by the address it's mapped to -
assuming there's following code -
handle h = createfile(l"some_dll.dll", generic_read, file_share_read | file_share_delete, null, open_existing, file_attribute_normal, null); handle map = createfilemapping(h, null, page_readonly | sec_image, 0, 0, null); lpvoid res = mapviewoffileex(map, 0, 0, 0, 0, 0);
is possible extract 'some_dll', given address it's mapped to, using c++ ?
when trying debug executable using windbg, seems doesn't extract module too
yes, getmappedfilename for:
checks whether specified address within memory-mapped file in address space of specified process. if so, function returns name of memory-mapped file.
ps: there's no reason windbg
show name of memory mapped file isn't loaded module, if file happens dll.
Comments
Post a Comment