For psycko a question:

What API of windows make the same work of the commang GMI, addr, CODEBASE and MODULEBASE

GMI addr, info
--------------
Gets information about a module to which the specified address belongs.
"info" can be MODULEBASE, MODULESIZE, CODEBASE or CODESIZE (if you want other info in the future versions plz tell me).
Sets the reserved $RESULT variable (0 if data not found).
Example:
GMI eip, CODEBASE // After this $RESULT is the address to the codebase of the module to which eip belongs

I need maje a inject in a program and i need a api, this api give me this info, i give to the api the adress and return me the base of the module of this adress.

How you implement this in ollyscript i think you know a api who make this work similar to the command GMI of your plugin.

Thanks

Hey Ricardo!

The GMI command uses the function Findmodule, which exists in the OllyDbg API. I don't really know how you can do that using Windows API right away, but I think I did something like that once... So it is possible. =) Ill try to find more info for you.

Thanks i use this api in my code.

Thanks again
Ricardo

hmm this FindWindow is not a WINDOW api, snif i need an api what make the same work of GMI, but i don't found.

Ricardo

Maybe the debugactiveprocess api will be of use. If memory serves, there is a struct that windows sends you with this info in it.

hope that helps,
will

Greetings,

a short circuit version which comes to my mind (not tested though):


MEMORY_BASIC_INFORMATION mi;
int result = ::VirtualQuery( address, &mi, sizeof(mi));

// mi contains allocation base of block
// additionally you might check for:
//
// mi.BaseAddress == mi.AllocationBase
// mi.type == MEM_IMAGE
// to be sure its module area

// module instance handle is the allocation base
TCHAR filename[ MAX_PATH];
int len = ::GetModuleFileName( (HINSTANCE) mi.AllocationBase, filename, MAX_PATH);


Oh well ... another one:

Use EnumerateLoadedModules() from image helper/debug helper API and loop through.
Check each module info entry if the address belongs to this module.
e.g. something like:



if( module_entry.BaseAddress <= my_address &&
((SIZE_T) module_entry.BaseAddress + module_entry.Length > (SIZE_T) my_address))
{
// within space, save module entry
}


Hope this helps...

Regards,

A. Focht

Maybe something that should be implemented in OSC? Anyone want that?