GetModules() [2/2]

static ProcessModuleCollection System.Diagnostics.NtProcessManager.GetModules ( int processId, bool firstModuleOnly )

inlinestaticprivate

Definition at line 444 of file NtProcessManager.cs.

    {
        if (processId == SystemProcessID || processId == 0)
        {
            throw new Win32Exception(-2147467259, System.SR.EnumProcessModuleFailed);
        }
        SafeProcessHandle safeProcessHandle = SafeProcessHandle.InvalidHandle;
        try
        {
            safeProcessHandle = ProcessManager.OpenProcess(processId, 1040, throwIfExited: true);
            if (!global::Interop.Kernel32.EnumProcessModules(safeProcessHandle, null, 0, out var needed))
            {
                if (!global::Interop.Kernel32.IsWow64Process(global::Interop.Kernel32.GetCurrentProcess(), out var Wow64Process))
                {
                    throw new Win32Exception();
                }
                if (!global::Interop.Kernel32.IsWow64Process(safeProcessHandle, out var Wow64Process2))
                {
                    throw new Win32Exception();
                }
                if (Wow64Process && !Wow64Process2)
                {
                    throw new Win32Exception(299, System.SR.EnumProcessModuleFailedDueToWow);
                }
                EnumProcessModulesUntilSuccess(safeProcessHandle, null, 0, out needed);
            }
            int num = needed / IntPtr.Size;
            IntPtr[] array = new IntPtr[num];
            while (true)
            {
                int num2 = needed;
                EnumProcessModulesUntilSuccess(safeProcessHandle, array, num2, out needed);
                if (num2 == needed)
                {
                    break;
                }
                if (needed > num2 && needed / IntPtr.Size > num)
                {
                    num = needed / IntPtr.Size;
                    array = new IntPtr[num];
                }
            }
            ProcessModuleCollection processModuleCollection = new ProcessModuleCollection(firstModuleOnly ? 1 : num);
            char[] array2 = ArrayPool<char>.Shared.Rent(260);
            try
            {
                for (int i = 0; i < num && (i <= 0 || !firstModuleOnly); i++)
                {
                    IntPtr moduleHandle = array[i];
                    if (!global::Interop.Kernel32.GetModuleInformation(safeProcessHandle, moduleHandle, out var ntModuleInfo))
                    {
                        HandleLastWin32Error();
                        continue;
                    }
                    ProcessModule processModule = new ProcessModule
                    {
                        ModuleMemorySize = ntModuleInfo.SizeOfImage,
                        EntryPointAddress = ntModuleInfo.EntryPoint,
                        BaseAddress = ntModuleInfo.BaseOfDll
                    };
                    int num3 = 0;
                    while ((num3 = global::Interop.Kernel32.GetModuleBaseName(safeProcessHandle, moduleHandle, array2, array2.Length)) == array2.Length)
                    {
                        char[] array3 = array2;
                        array2 = ArrayPool<char>.Shared.Rent(num3 * 2);
                        ArrayPool<char>.Shared.Return(array3);
                    }
                    if (num3 == 0)
                    {
                        processModule.Dispose();
                        HandleLastWin32Error();
                        continue;
                    }
                    processModule.ModuleName = new string(array2, 0, num3);
                    while ((num3 = global::Interop.Kernel32.GetModuleFileNameEx(safeProcessHandle, moduleHandle, array2, array2.Length)) == array2.Length)
                    {
                        char[] array4 = array2;
                        array2 = ArrayPool<char>.Shared.Rent(num3 * 2);
                        ArrayPool<char>.Shared.Return(array4);
                    }
                    if (num3 == 0)
                    {
                        processModule.Dispose();
                        HandleLastWin32Error();
                        continue;
                    }
                    ReadOnlySpan<char> span = array2.AsSpan(0, num3);
                    if (span.StartsWith("\\\\?\\"))
                    {
                        span = span.Slice("\\\\?\\".Length);
                    }
                    processModule.FileName = span.ToString();
                    processModuleCollection.Add(processModule);
                }
            }
            finally
            {
                ArrayPool<char>.Shared.Return(array2);
            }
            return processModuleCollection;
        }
        finally
        {
            if (!safeProcessHandle.IsInvalid)
            {
                safeProcessHandle.Dispose();
            }
        }
    }

References System.Collections.Generic.Dictionary< TKey, TValue >.Add(), System.array, System.SR.EnumProcessModuleFailed, System.SR.EnumProcessModuleFailedDueToWow, System.Diagnostics.NtProcessManager.EnumProcessModulesUntilSuccess(), System.Diagnostics.NtProcessManager.HandleLastWin32Error(), Microsoft.Win32.SafeHandles.SafeProcessHandle.InvalidHandle, System.Diagnostics.ProcessManager.OpenProcess(), System.IntPtr.Size, and System.Diagnostics.NtProcessManager.SystemProcessID.