Thread: How do I... (process operations)

...get the base address of a process?

Here's something I wrote a while ago to do that:

Code:

   HANDLE        hProcessSnap = NULL;
   PROCESSENTRY32 pe32        = { 0 };

   hProcessSnap = CreateToolhelp32Snapshot ( TH32CS_SNAPPROCESS, 0);
   if ( hProcessSnap == ( HANDLE ) -1 )
       return;

   pe32.dwSize = sizeof ( PROCESSENTRY32 );

   if ( Process32First ( hProcessSnap, &pe32 ) )
   {
       do
       {
            if ( pe32.th32ProcessID )      // Skip the system idle process
            {
               HANDLE hModuleSnap = CreateToolhelp32Snapshot ( TH32CS_SNAPMODULE, pe32.th32ProcessID );
               MODULEENTRY32 me32        = { 0 };

               if (hModuleSnap != ( HANDLE ) -1)
               {
                  me32.dwSize = sizeof ( MODULEENTRY32 );

                  if ( Module32First ( hModuleSnap, &me32 ) )
                  {
                     do
                     {
                     	// All info you need is now in "me32". First module is the process itself, rest of modules are the dll's it's using
                     }
                     while ( Module32Next ( hModuleSnap, &me32 ) );
                     CloseHandle (hModuleSnap);
                  }
               }
            }
       }
       while ( Process32Next ( hProcessSnap, &pe32 ) );
   }
   CloseHandle ( hProcessSnap );

If you know the process id, then you can pass it directly, and not have to scan every process like the above snippet does. See the MSDN for how the functions work.