获取函数所在模块的方法
学习VLD2.0代码,看到如下函数:
HMODULE GetCallingModule( UINT_PTR pCaller )
{
HMODULE hModule = NULL;
MEMORY_BASIC_INFORMATION mbi;
if ( VirtualQuery((LPCVOID)pCaller, &mbi, sizeof(MEMORY_BASIC_INFORMATION)) == sizeof(MEMORY_BASIC_INFORMATION) )
{
// the allocation base is the beginning of a PE file
hModule = (HMODULE) mbi.AllocationBase;
}
return hModule;
}
入参是函数地址或eip/rip,可以得到其所在的模块句柄。