Get loaded module from another process - c++

Question

I want to get all modules from another process. But it returns absurd values. Program stay in do-while loop for one time. After that exits from do-while loop.
I can't find where is the mistake - how can I fix this? I know that program must be in do-while loop for several time but it don't.
NTSTATUS Status;
PROCESS_BASIC_INFORMATION pbi;
ULONG ReturnLength;
Status = NtQueryInformationProcess(
INJECTOR_INFO.process.processHandle,
ProcessBasicInformation,
&pbi,
sizeof(PROCESS_BASIC_INFORMATION),
&ReturnLength);
if (!NT_SUCCESS(Status)) {
printf("NtQueryInformationProcess failed.(pbi)\n");
return;
}
else {
PLIST_ENTRY HeadEntry = pbi.PebBaseAddress->LoaderData->InMemoryOrderModuleList.Flink;
PLIST_ENTRY nextEntry = pbi.PebBaseAddress->LoaderData->InMemoryOrderModuleList.Blink;
DWORD dwBytesRead = 0;
PLDR_MODULE pLdrModule = nullptr;
LDR_MODULE LdrModule;
do
{
LDR_DATA_TABLE_ENTRY LdrEntry;
PLDR_DATA_TABLE_ENTRY Base = CONTAINING_RECORD(HeadEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
if (NT_SUCCESS(Status = NtReadVirtualMemory(INJECTOR_INFO.process.processHandle, Base, &LdrEntry, sizeof(LdrEntry), &dwBytesRead)))
{
if (dwBytesRead != sizeof(LdrEntry)) {
printf("length doesn't match");
return;
}
char* pLdrModuleOffset = reinterpret_cast<char*>(HeadEntry) - sizeof(LIST_ENTRY);
if (!NT_SUCCESS(Status = NtReadVirtualMemory(INJECTOR_INFO.process.processHandle, pLdrModuleOffset, &pLdrModule, sizeof(pLdrModule), &dwBytesRead))) {
printf("pLdrModuleOffset doesn't read"); return;
}else if (dwBytesRead != sizeof(pLdrModule)) { printf("pLdrModule length doesn't match"); return; }
if (!NT_SUCCESS(Status = NtReadVirtualMemory(INJECTOR_INFO.process.processHandle, pLdrModule, &LdrModule, sizeof(LdrModule), &dwBytesRead))) {
printf("pLdrModule doesn't read"); return;
}else if (dwBytesRead != sizeof(LdrModule)) { printf("LdrModule length doesn't match"); return; }
if (LdrEntry.DllBase)
{
printf("BaseAddress: %p\n", LdrModule.BaseAddress);
printf("Reference Count: %d\n", LdrModule.LoadCount);
}
HeadEntry = LdrEntry.InMemoryOrderLinks.Flink;
}
else { printf("LDR_DATA_TABLE_ENTRY doesn't read"); return; }
} while (HeadEntry != nextEntry);
}
I put breakpoint on !NT_SUCCESS(Status) after NtQueryInformationProcess for values of variables:
Values after NtQueryInformationProcess
Another breakpoint for values of variables in do while for the end of the first cycle:
Values for the end of the first cycle

Answer 1

You are querying a remote process for it's PROCESS_BASIC_INFORMATION, but then you proceed to follow the pointers in your own process:
PLIST_ENTRY HeadEntry = pbi.PebBaseAddress->LoaderData->InMemoryOrderModuleList.Flink;
For this to work, read the PEB from the remote process (from pbi.PebBaseAddress),
then read the LoaderData from the remote process (PEB.LoaderData).
Then, follow the InMemoryOrderModuleList (again, read the data from the remote process).
At this point you can iterate over the entire list, by reading each entry from the remote process.