How do I determine information on the DLLs that are loaded in a 64bit
process from a 32bit process on WIN64?

If I use PSAPI, I get errors indicating that the virtual memory (of the
64bit process) was only partially read.
The ToolHelp API fails even sooner than the PSAPI API.

My code is similar to the PSAPI example:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/base/enumerating_all_modules_for_a_process.asp


Any ideas?

Pieter

Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Pavel

Pavel
Wed Jun 08 03:16:46 CDT 2005

sizeof(HMODULE) is different on 64 bit so these functions can't
work across 32->64 boundary.

--
This posting is provided "AS IS" with no warranties, and confers no
rights.

"Pieter" wrote:

> How do I determine information on the DLLs that are loaded in a 64bit
> process from a 32bit process on WIN64?
>
> If I use PSAPI, I get errors indicating that the virtual memory (of the
> 64bit process) was only partially read.
> The ToolHelp API fails even sooner than the PSAPI API.
>
> My code is similar to the PSAPI example:
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/base/enumerating_all_modules_for_a_process.asp



Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Pieter

Pieter
Wed Jun 08 13:38:24 CDT 2005

Maybe I wasn't specific enough, I want the process- and the DLL path names.

I.e. From my WoW64 WIN32 process, I want to iterate all processes (WoW64
WIN32 and native WIN64) and determine the path to each EXE and each DLL in
that EXE.

Any more ideas?

are different
"Pavel Lebedinsky [MSFT]" <pavel@online.microsoft.com> wrote in message
news:OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl...
> sizeof(HMODULE) is different on 64 bit so these functions can't
> work across 32->64 boundary.
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> "Pieter" wrote:
>
>> How do I determine information on the DLLs that are loaded in a 64bit
>> process from a 32bit process on WIN64?
>>
>> If I use PSAPI, I get errors indicating that the virtual memory (of the
>> 64bit process) was only partially read.
>> The ToolHelp API fails even sooner than the PSAPI API.
>>
>> My code is similar to the PSAPI example:
>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/base/enumerating_all_modules_for_a_process.asp
>
>



Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Darrellg

Darrellg
Wed Jun 08 17:01:06 CDT 2005

Hello Pieter,
You may want to try depends.exe from the support.cab on the cd.
Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
<From: "Pieter" <msnews@insanegenius.com>
<References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
<OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
<Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
process?
<Date: Wed, 8 Jun 2005 11:38:24 -0700
<Lines: 33
<X-Priority: 3
<X-MSMail-Priority: Normal
<X-Newsreader: Microsoft Outlook Express 6.00.3790.1830
<X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
<X-RFC2646: Format=Flowed; Response
<Message-ID: <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
<Newsgroups:
microsoft.public.win32.programmer.kernel,microsoft.public.windows.64bit.gene
ral
<NNTP-Posting-Host: 65.88.178.10
<Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
<Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6502
microsoft.public.win32.programmer.kernel:12451
<X-Tomcat-NG: microsoft.public.windows.64bit.general
<
<Maybe I wasn't specific enough, I want the process- and the DLL path names.
<
<I.e. From my WoW64 WIN32 process, I want to iterate all processes (WoW64
<WIN32 and native WIN64) and determine the path to each EXE and each DLL in
<that EXE.
<
<Any more ideas?
<
< are different
<"Pavel Lebedinsky [MSFT]" <pavel@online.microsoft.com> wrote in message
<news:OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl...
<> sizeof(HMODULE) is different on 64 bit so these functions can't
<> work across 32->64 boundary.
<>
<> --
<> This posting is provided "AS IS" with no warranties, and confers no
<> rights.
<>
<> "Pieter" wrote:
<>
<>> How do I determine information on the DLLs that are loaded in a 64bit
<>> process from a 32bit process on WIN64?
<>>
<>> If I use PSAPI, I get errors indicating that the virtual memory (of the
<>> 64bit process) was only partially read.
<>> The ToolHelp API fails even sooner than the PSAPI API.
<>>
<>> My code is similar to the PSAPI example:
<>>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/bas
e/enumerating_all_modules_for_a_process.asp
<>
<>
<
<
<


Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Darrellg

Darrellg
Wed Jun 08 17:06:46 CDT 2005

Hello Pieter,
Posted too quickly, after it's open, choose the view menu and select full
paths option to get the pathing to the files.
Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
<X-Tomcat-ID: 542463493
<References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
<OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
<OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
<MIME-Version: 1.0
<Content-Type: text/plain
<Content-Transfer-Encoding: 7bit
<From: Darrellg@online.microsoft.com ("Darrell Gorter[MSFT]")
<Organization: Microsoft
<Date: Wed, 08 Jun 2005 22:01:06 GMT
<Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
process?
<X-Tomcat-NG: microsoft.public.windows.64bit.general
<Message-ID: <YRHZRWHbFHA.2476@TK2MSFTNGXA01.phx.gbl>
<Newsgroups: microsoft.public.windows.64bit.general
<Lines: 57
<Path: TK2MSFTNGXA01.phx.gbl
<Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6538
<NNTP-Posting-Host: tomcatimport2.phx.gbl 10.201.218.182
<
<Hello Pieter,
<You may want to try depends.exe from the support.cab on the cd.
<Thanks,
<Darrell Gorter[MSFT]
<
<This posting is provided "AS IS" with no warranties, and confers no rights
<--------------------
<<From: "Pieter" <msnews@insanegenius.com>
<<References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
<<OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
<<Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
<process?
<<Date: Wed, 8 Jun 2005 11:38:24 -0700
<<Lines: 33
<<X-Priority: 3
<<X-MSMail-Priority: Normal
<<X-Newsreader: Microsoft Outlook Express 6.00.3790.1830
<<X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
<<X-RFC2646: Format=Flowed; Response
<<Message-ID: <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
<<Newsgroups:
<microsoft.public.win32.programmer.kernel,microsoft.public.windows.64bit.gen
e
<ral
<<NNTP-Posting-Host: 65.88.178.10
<<Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
<<Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6502
<microsoft.public.win32.programmer.kernel:12451
<<X-Tomcat-NG: microsoft.public.windows.64bit.general
<<
<<Maybe I wasn't specific enough, I want the process- and the DLL path
names.
<<
<<I.e. From my WoW64 WIN32 process, I want to iterate all processes (WoW64
<<WIN32 and native WIN64) and determine the path to each EXE and each DLL
in
<<that EXE.
<<
<<Any more ideas?
<<
<< are different
<<"Pavel Lebedinsky [MSFT]" <pavel@online.microsoft.com> wrote in message
<<news:OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl...
<<> sizeof(HMODULE) is different on 64 bit so these functions can't
<<> work across 32->64 boundary.
<<>
<<> --
<<> This posting is provided "AS IS" with no warranties, and confers no
<<> rights.
<<>
<<> "Pieter" wrote:
<<>
<<>> How do I determine information on the DLLs that are loaded in a 64bit
<<>> process from a 32bit process on WIN64?
<<>>
<<>> If I use PSAPI, I get errors indicating that the virtual memory (of
the
<<>> 64bit process) was only partially read.
<<>> The ToolHelp API fails even sooner than the PSAPI API.
<<>>
<<>> My code is similar to the PSAPI example:
<<>>
<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/ba
s
<e/enumerating_all_modules_for_a_process.asp
<<>
<<>
<<
<<
<<
<
<


Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Pieter

Pieter
Thu Jun 09 14:44:08 CDT 2005

Depends shows static dependency information, this does not meet my
requirements.

I am interested in which processes are running now, and which DLLs are
loaded in those processes.

Any other ideas?

""Darrell Gorter[MSFT]"" <Darrellg@online.microsoft.com> wrote in message
news:bX59bZHbFHA.3928@TK2MSFTNGXA01.phx.gbl...
> Hello Pieter,
> Posted too quickly, after it's open, choose the view menu and select full
> paths option to get the pathing to the files.
> Thanks,
> Darrell Gorter[MSFT]
>
> This posting is provided "AS IS" with no warranties, and confers no rights
> --------------------
> <X-Tomcat-ID: 542463493
> <References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
> <OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
> <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
> <MIME-Version: 1.0
> <Content-Type: text/plain
> <Content-Transfer-Encoding: 7bit
> <From: Darrellg@online.microsoft.com ("Darrell Gorter[MSFT]")
> <Organization: Microsoft
> <Date: Wed, 08 Jun 2005 22:01:06 GMT
> <Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
> process?
> <X-Tomcat-NG: microsoft.public.windows.64bit.general
> <Message-ID: <YRHZRWHbFHA.2476@TK2MSFTNGXA01.phx.gbl>
> <Newsgroups: microsoft.public.windows.64bit.general
> <Lines: 57
> <Path: TK2MSFTNGXA01.phx.gbl
> <Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6538
> <NNTP-Posting-Host: tomcatimport2.phx.gbl 10.201.218.182
> <
> <Hello Pieter,
> <You may want to try depends.exe from the support.cab on the cd.
> <Thanks,
> <Darrell Gorter[MSFT]
> <
> <This posting is provided "AS IS" with no warranties, and confers no
> rights
> <--------------------
> <<From: "Pieter" <msnews@insanegenius.com>
> <<References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
> <<OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
> <<Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
> <process?
> <<Date: Wed, 8 Jun 2005 11:38:24 -0700
> <<Lines: 33
> <<X-Priority: 3
> <<X-MSMail-Priority: Normal
> <<X-Newsreader: Microsoft Outlook Express 6.00.3790.1830
> <<X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
> <<X-RFC2646: Format=Flowed; Response
> <<Message-ID: <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
> <<Newsgroups:
> <microsoft.public.win32.programmer.kernel,microsoft.public.windows.64bit.gen
> e
> <ral
> <<NNTP-Posting-Host: 65.88.178.10
> <<Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
> <<Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6502
> <microsoft.public.win32.programmer.kernel:12451
> <<X-Tomcat-NG: microsoft.public.windows.64bit.general
> <<
> <<Maybe I wasn't specific enough, I want the process- and the DLL path
> names.
> <<
> <<I.e. From my WoW64 WIN32 process, I want to iterate all processes (WoW64
> <<WIN32 and native WIN64) and determine the path to each EXE and each DLL
> in
> <<that EXE.
> <<
> <<Any more ideas?
> <<
> << are different
> <<"Pavel Lebedinsky [MSFT]" <pavel@online.microsoft.com> wrote in message
> <<news:OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl...
> <<> sizeof(HMODULE) is different on 64 bit so these functions can't
> <<> work across 32->64 boundary.
> <<>
> <<> --
> <<> This posting is provided "AS IS" with no warranties, and confers no
> <<> rights.
> <<>
> <<> "Pieter" wrote:
> <<>
> <<>> How do I determine information on the DLLs that are loaded in a 64bit
> <<>> process from a 32bit process on WIN64?
> <<>>
> <<>> If I use PSAPI, I get errors indicating that the virtual memory (of
> the
> <<>> 64bit process) was only partially read.
> <<>> The ToolHelp API fails even sooner than the PSAPI API.
> <<>>
> <<>> My code is similar to the PSAPI example:
> <<>>
> <http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/ba
> s
> <e/enumerating_all_modules_for_a_process.asp
> <<>
> <<>
> <<
> <<
> <<
> <
> <
>



Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Jason

Jason
Thu Jun 09 15:04:08 CDT 2005

On Thu, 9 Jun 2005 12:44:08 -0700, "Pieter" <msnews@insanegenius.com>
wrote:

>Depends shows static dependency information, this does not meet my
>requirements.
>
>I am interested in which processes are running now, and which DLLs are
>loaded in those processes.
>
>Any other ideas?

How about this?

http://www.sysinternals.com/Utilities/ProcessExplorer.html

Start up Process Explorer to show active processes, select
View--->Lower Panel View---> DLLs

-jd
j e d @ comcast.net


Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Pieter

Pieter
Thu Jun 09 16:39:51 CDT 2005

I am not looking for utilities, I am looking for C++ code.

FYI...
You will notice that process explorer is a WIN32 application, that carries a
WIN64 application as an embedded binary resource.
When executing the WIN32 process on a WIN64 system, the WIN32 process
extracts and launches the embedded WIN64 application.
Thus it is not a WIN32 application that shows the system information, it is
actually a WIN64 application.
They actually go further by also launching a kernel mode driver (also
embedded as a binary resource) to extract other information that is not
directly available in usermode.


"Jason Durbin" <jedurbin@example.com.invalid> wrote in message
news:nt7ha1ppls1vt9ks1nqv8e0r2ji58jp1ss@4ax.com...
> On Thu, 9 Jun 2005 12:44:08 -0700, "Pieter" <msnews@insanegenius.com>
> wrote:
>
>>Depends shows static dependency information, this does not meet my
>>requirements.
>>
>>I am interested in which processes are running now, and which DLLs are
>>loaded in those processes.
>>
>>Any other ideas?
>
> How about this?
>
> http://www.sysinternals.com/Utilities/ProcessExplorer.html
>
> Start up Process Explorer to show active processes, select
> View--->Lower Panel View---> DLLs
>
> -jd
> j e d @ comcast.net
>



Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Darrellg

Darrellg
Thu Jun 09 16:46:07 CDT 2005

Hello Pieter,
If just want the dlls names then tasklist /m shows that.
But I am not sure that's everything. It only shows the dlls, not where
they are located.
Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
<From: "Pieter" <msnews@insanegenius.com>
<References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
<OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
<OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
<YRHZRWHbFHA.2476@TK2MSFTNGXA01.phx.gbl>
<bX59bZHbFHA.3928@TK2MSFTNGXA01.phx.gbl>
<Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
process?
<Date: Thu, 9 Jun 2005 12:44:08 -0700
<Lines: 114
<X-Priority: 3
<X-MSMail-Priority: Normal
<X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
<X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
<X-RFC2646: Format=Flowed; Original
<Message-ID: <O7iybuSbFHA.612@TK2MSFTNGP12.phx.gbl>
<Newsgroups: microsoft.public.windows.64bit.general
<NNTP-Posting-Host: 65.88.178.10
<Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
<Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6666
<X-Tomcat-NG: microsoft.public.windows.64bit.general
<
<Depends shows static dependency information, this does not meet my
<requirements.
<
<I am interested in which processes are running now, and which DLLs are
<loaded in those processes.
<
<Any other ideas?
<
<""Darrell Gorter[MSFT]"" <Darrellg@online.microsoft.com> wrote in message
<news:bX59bZHbFHA.3928@TK2MSFTNGXA01.phx.gbl...
<> Hello Pieter,
<> Posted too quickly, after it's open, choose the view menu and select full
<> paths option to get the pathing to the files.
<> Thanks,
<> Darrell Gorter[MSFT]
<>
<> This posting is provided "AS IS" with no warranties, and confers no
rights
<> --------------------
<> <X-Tomcat-ID: 542463493
<> <References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
<> <OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
<> <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
<> <MIME-Version: 1.0
<> <Content-Type: text/plain
<> <Content-Transfer-Encoding: 7bit
<> <From: Darrellg@online.microsoft.com ("Darrell Gorter[MSFT]")
<> <Organization: Microsoft
<> <Date: Wed, 08 Jun 2005 22:01:06 GMT
<> <Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
<> process?
<> <X-Tomcat-NG: microsoft.public.windows.64bit.general
<> <Message-ID: <YRHZRWHbFHA.2476@TK2MSFTNGXA01.phx.gbl>
<> <Newsgroups: microsoft.public.windows.64bit.general
<> <Lines: 57
<> <Path: TK2MSFTNGXA01.phx.gbl
<> <Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6538
<> <NNTP-Posting-Host: tomcatimport2.phx.gbl 10.201.218.182
<> <
<> <Hello Pieter,
<> <You may want to try depends.exe from the support.cab on the cd.
<> <Thanks,
<> <Darrell Gorter[MSFT]
<> <
<> <This posting is provided "AS IS" with no warranties, and confers no
<> rights
<> <--------------------
<> <<From: "Pieter" <msnews@insanegenius.com>
<> <<References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
<> <<OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
<> <<Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
<> <process?
<> <<Date: Wed, 8 Jun 2005 11:38:24 -0700
<> <<Lines: 33
<> <<X-Priority: 3
<> <<X-MSMail-Priority: Normal
<> <<X-Newsreader: Microsoft Outlook Express 6.00.3790.1830
<> <<X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
<> <<X-RFC2646: Format=Flowed; Response
<> <<Message-ID: <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
<> <<Newsgroups:
<>
<microsoft.public.win32.programmer.kernel,microsoft.public.windows.64bit.gen
<> e
<> <ral
<> <<NNTP-Posting-Host: 65.88.178.10
<> <<Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
<> <<Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6502
<> <microsoft.public.win32.programmer.kernel:12451
<> <<X-Tomcat-NG: microsoft.public.windows.64bit.general
<> <<
<> <<Maybe I wasn't specific enough, I want the process- and the DLL path
<> names.
<> <<
<> <<I.e. From my WoW64 WIN32 process, I want to iterate all processes
(WoW64
<> <<WIN32 and native WIN64) and determine the path to each EXE and each DLL
<> in
<> <<that EXE.
<> <<
<> <<Any more ideas?
<> <<
<> << are different
<> <<"Pavel Lebedinsky [MSFT]" <pavel@online.microsoft.com> wrote in message
<> <<news:OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl...
<> <<> sizeof(HMODULE) is different on 64 bit so these functions can't
<> <<> work across 32->64 boundary.
<> <<>
<> <<> --
<> <<> This posting is provided "AS IS" with no warranties, and confers no
<> <<> rights.
<> <<>
<> <<> "Pieter" wrote:
<> <<>
<> <<>> How do I determine information on the DLLs that are loaded in a
64bit
<> <<>> process from a 32bit process on WIN64?
<> <<>>
<> <<>> If I use PSAPI, I get errors indicating that the virtual memory (of
<> the
<> <<>> 64bit process) was only partially read.
<> <<>> The ToolHelp API fails even sooner than the PSAPI API.
<> <<>>
<> <<>> My code is similar to the PSAPI example:
<> <<>>
<>
<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/ba
<> s
<> <e/enumerating_all_modules_for_a_process.asp
<> <<>
<> <<>
<> <<
<> <<
<> <<
<> <
<> <
<>
<
<
<


Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Pieter

Pieter
Thu Jun 09 16:56:00 CDT 2005

I am not looking for utilities, I am looking for C++ code.

""Darrell Gorter[MSFT]"" <Darrellg@online.microsoft.com> wrote in message
news:%23S$nnyTbFHA.2184@TK2MSFTNGXA01.phx.gbl...
> Hello Pieter,
> If just want the dlls names then tasklist /m shows that.
> But I am not sure that's everything. It only shows the dlls, not where
> they are located.
> Thanks,
> Darrell Gorter[MSFT]
>
> This posting is provided "AS IS" with no warranties, and confers no rights
> --------------------
> <From: "Pieter" <msnews@insanegenius.com>
> <References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
> <OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
> <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
> <YRHZRWHbFHA.2476@TK2MSFTNGXA01.phx.gbl>
> <bX59bZHbFHA.3928@TK2MSFTNGXA01.phx.gbl>
> <Subject: Re: How to determine DLLs loaded in 64bit process from a 32bit
> process?
> <Date: Thu, 9 Jun 2005 12:44:08 -0700
> <Lines: 114
> <X-Priority: 3
> <X-MSMail-Priority: Normal
> <X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
> <X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
> <X-RFC2646: Format=Flowed; Original
> <Message-ID: <O7iybuSbFHA.612@TK2MSFTNGP12.phx.gbl>
> <Newsgroups: microsoft.public.windows.64bit.general
> <NNTP-Posting-Host: 65.88.178.10
> <Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
> <Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.64bit.general:6666
> <X-Tomcat-NG: microsoft.public.windows.64bit.general
> <
> <Depends shows static dependency information, this does not meet my
> <requirements.
> <
> <I am interested in which processes are running now, and which DLLs are
> <loaded in those processes.
> <
> <Any other ideas?
> <
> <""Darrell Gorter[MSFT]"" <Darrellg@online.microsoft.com> wrote in message
> <news:bX59bZHbFHA.3928@TK2MSFTNGXA01.phx.gbl...
> <> Hello Pieter,
> <> Posted too quickly, after it's open, choose the view menu and select
> full
> <> paths option to get the pathing to the files.
> <> Thanks,
> <> Darrell Gorter[MSFT]
> <>
> <> This posting is provided "AS IS" with no warranties, and confers no
> rights
> <> --------------------
> <> <X-Tomcat-ID: 542463493
> <> <References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
> <> <OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
> <> <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
> <> <MIME-Version: 1.0
> <> <Content-Type: text/plain
> <> <Content-Transfer-Encoding: 7bit
> <> <From: Darrellg@online.microsoft.com ("Darrell Gorter[MSFT]")
> <> <Organization: Microsoft
> <> <Date: Wed, 08 Jun 2005 22:01:06 GMT
> <> <Subject: Re: How to determine DLLs loaded in 64bit process from a
> 32bit
> <> process?
> <> <X-Tomcat-NG: microsoft.public.windows.64bit.general
> <> <Message-ID: <YRHZRWHbFHA.2476@TK2MSFTNGXA01.phx.gbl>
> <> <Newsgroups: microsoft.public.windows.64bit.general
> <> <Lines: 57
> <> <Path: TK2MSFTNGXA01.phx.gbl
> <> <Xref: TK2MSFTNGXA01.phx.gbl
> microsoft.public.windows.64bit.general:6538
> <> <NNTP-Posting-Host: tomcatimport2.phx.gbl 10.201.218.182
> <> <
> <> <Hello Pieter,
> <> <You may want to try depends.exe from the support.cab on the cd.
> <> <Thanks,
> <> <Darrell Gorter[MSFT]
> <> <
> <> <This posting is provided "AS IS" with no warranties, and confers no
> <> rights
> <> <--------------------
> <> <<From: "Pieter" <msnews@insanegenius.com>
> <> <<References: <e8BECYvaFHA.2356@TK2MSFTNGP10.phx.gbl>
> <> <<OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl>
> <> <<Subject: Re: How to determine DLLs loaded in 64bit process from a
> 32bit
> <> <process?
> <> <<Date: Wed, 8 Jun 2005 11:38:24 -0700
> <> <<Lines: 33
> <> <<X-Priority: 3
> <> <<X-MSMail-Priority: Normal
> <> <<X-Newsreader: Microsoft Outlook Express 6.00.3790.1830
> <> <<X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
> <> <<X-RFC2646: Format=Flowed; Response
> <> <<Message-ID: <OPvFKhFbFHA.2420@TK2MSFTNGP12.phx.gbl>
> <> <<Newsgroups:
> <>
> <microsoft.public.win32.programmer.kernel,microsoft.public.windows.64bit.gen
> <> e
> <> <ral
> <> <<NNTP-Posting-Host: 65.88.178.10
> <> <<Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
> <> <<Xref: TK2MSFTNGXA01.phx.gbl
> microsoft.public.windows.64bit.general:6502
> <> <microsoft.public.win32.programmer.kernel:12451
> <> <<X-Tomcat-NG: microsoft.public.windows.64bit.general
> <> <<
> <> <<Maybe I wasn't specific enough, I want the process- and the DLL path
> <> names.
> <> <<
> <> <<I.e. From my WoW64 WIN32 process, I want to iterate all processes
> (WoW64
> <> <<WIN32 and native WIN64) and determine the path to each EXE and each
> DLL
> <> in
> <> <<that EXE.
> <> <<
> <> <<Any more ideas?
> <> <<
> <> << are different
> <> <<"Pavel Lebedinsky [MSFT]" <pavel@online.microsoft.com> wrote in
> message
> <> <<news:OS4FjJAbFHA.2440@TK2MSFTNGP10.phx.gbl...
> <> <<> sizeof(HMODULE) is different on 64 bit so these functions can't
> <> <<> work across 32->64 boundary.
> <> <<>
> <> <<> --
> <> <<> This posting is provided "AS IS" with no warranties, and confers no
> <> <<> rights.
> <> <<>
> <> <<> "Pieter" wrote:
> <> <<>
> <> <<>> How do I determine information on the DLLs that are loaded in a
> 64bit
> <> <<>> process from a 32bit process on WIN64?
> <> <<>>
> <> <<>> If I use PSAPI, I get errors indicating that the virtual memory
> (of
> <> the
> <> <<>> 64bit process) was only partially read.
> <> <<>> The ToolHelp API fails even sooner than the PSAPI API.
> <> <<>>
> <> <<>> My code is similar to the PSAPI example:
> <> <<>>
> <>
> <http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/ba
> <> s
> <> <e/enumerating_all_modules_for_a_process.asp
> <> <<>
> <> <<>
> <> <<
> <> <<
> <> <<
> <> <
> <> <
> <>
> <
> <
> <
>



Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Pavel

Pavel
Sat Jun 11 01:26:51 CDT 2005

"Pieter" wrote:

> Maybe I wasn't specific enough, I want the process- and the DLL path
> names.
>
> I.e. From my WoW64 WIN32 process, I want to iterate all processes (WoW64
> WIN32 and native WIN64) and determine the path to each EXE and each DLL in
> that EXE.
>
> Any more ideas?

I suspect that there is no way to do this. Information about loaded modules
is maintained in user mode (in the form of linked lists in the PEB) so
getting
to it from another process is a bit tricky. Things like EnumProcessModules
are not even guaranteed to be 100% reliable since the target process can
mess with its PEB and change the results. These APIs really exist for use by
tools like debuggers or tlist.exe, and have inherent limitations when you
try
to use them from a 32 bit process against a 64 one (just like a 32 bit
debugger would have problems debugging a 64 bit target).

--
This posting is provided "AS IS" with no warranties, and confers no
rights.



Re: How to determine DLLs loaded in 64bit process from a 32bit process? by Pieter

Pieter
Sun Jun 12 11:34:48 CDT 2005

Thanks, direct exploration of the PEB was my next avenue of research.

In the June 2005 issue of C/C++ users journal:
http://www.cuj.com/documents/s=8188/cuj0506brown/
There is an article that mentions interesting looking functions, if I
interpret the names correctly, I should be able to view the PEB of a 64bit
process from my 32bit process.

Do you have any more information on the undocumented:
NtWow64QueryInformationProcess64()
NtWow64QueryVirtualMemory64()
NtWow64ReadVirtualMemory64()


Pieter

"Pavel Lebedinsky [MSFT]" <pavel@online.microsoft.com> wrote in message
news:u46Oj5kbFHA.3620@TK2MSFTNGP09.phx.gbl...
> "Pieter" wrote:
>
>> Maybe I wasn't specific enough, I want the process- and the DLL path
>> names.
>>
>> I.e. From my WoW64 WIN32 process, I want to iterate all processes (WoW64
>> WIN32 and native WIN64) and determine the path to each EXE and each DLL
>> in that EXE.
>>
>> Any more ideas?
>
> I suspect that there is no way to do this. Information about loaded
> modules
> is maintained in user mode (in the form of linked lists in the PEB) so
> getting
> to it from another process is a bit tricky. Things like EnumProcessModules
> are not even guaranteed to be 100% reliable since the target process can
> mess with its PEB and change the results. These APIs really exist for use
> by
> tools like debuggers or tlist.exe, and have inherent limitations when you
> try
> to use them from a 32 bit process against a 64 one (just like a 32 bit
> debugger would have problems debugging a 64 bit target).
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>