Search code examples
c++windowsimportportable-executable

Reading the import table of a running process

Is there a way to read the the import table of another process?
The function ImageNtHeader won't help me here, because it applies only to my process and not to the other process.
I know I can read the entire file and parse its PE header, but I'm afraid it will take a lot of time if the file is large.

Is there a way to do it using the process's memory directly and not reading from the file?
Any other easy and nice way to do it will be great as well :)

Solution

  • just use psapi or toolhlp32 to find the memory addresses of the processes modules you are interested in. once you have that you can use ReadProcessMemory get the required info. else just pretend to be a debugger and attach to the target process so you have full access to it's memory, then you can use the windows PE macros.