x32下的DLL隐藏(2)

检测:

MEMORY_BASIC_INFORMATION mbi_thunk;
 PVOID AllocationBase = NULL;
 TCHAR FilePath[MAX_PATH];
 for (LPSTR Addr = (LPSTR)0x00000000; ::VirtualQueryEx(hProcess,Addr,&mbi_thunk,sizeof(mbi_thunk)); Addr = LPSTR(mbi_thunk.BaseAddress) + mbi_thunk.RegionSize)
 {
  if ((mbi_thunk.AllocationBase > AllocationBase) && (GetMappedFileName(hProcess,mbi_thunk.BaseAddress,FilePath,_countof(FilePath)) > 0))
  {
   AllocationBase = mbi_thunk.AllocationBase;
   KdPrint((_T("MODULE:%x,%s\r\n"),AllocationBase,FilePath));
  }
 }

（编辑：ASP站长网）