List of DLLs loaded by specific process by its name

Question

I'm trying to list dll(s) loaded to processe with the following code:

Process[] ObjModulesList = Process.GetProcessesByName("iexplore");

foreach (Process prc in ObjModulesList)
{
    ProcessModuleCollection ObjModules = prc.Modules;
    foreach (ProcessModule objModule in ObjModules)
    {
        string strModulePath = objModule.FileName.ToString();
        Console.WriteLine(strModulePath);
    }
}

I'm getting error

A 32 bit processes cannot access modules of a 64 bit process.

I tried to run my process as administrator, and running iexplore as 64-bit and as 32-bit. None of those working.

BTW, I have to compile my program to 32-bit.

Any ideas?

If you compile your app as 64 bit, do you get the reverse error? — Steve Danner, Oct 21 '15 at 14:15
No. still the same:"A 32 bit processes cannot access modules of a 64 bit process." — AK87, Oct 21 '15 at 14:16
And how exactly did you make your application compile as 64-bit? Did you check in task manager that your application is *actually* running as 64-bit? Are you even running the correct exe? — Luaan, Oct 21 '15 at 14:18
The top suggested related [question](http://stackoverflow.com/questions/3801517/how-to-enum-modules-in-a-64bit-process-from-a-32bit-wow-process?rq=1) seems to have most of the answer (it's not .NET, but since it fundamentally says "you can't get this information natively", there's no reason to expect .NET to change the maths here) — Damien_The_Unbeliever, Oct 21 '15 at 14:35
32bit IE still uses x64bit components on an x64bit system. It's weird, but I've encountered the same issue. Can't remember enough info about how I worked around it, unfortunately :/ — , Oct 21 '15 at 14:46

score 1 · Accepted Answer · answered Oct 22 '15 at 10:08

You can use WMI, here is a piece of code that gets all processes and relative modules:

var wmiQueryString = string.Format("select * from CIM_ProcessExecutable");
Dictionary<int, ProcInfo> procsMods = new Dictionary<int, ProcInfo>();
using (var searcher = new ManagementObjectSearcher(string.Format(wmiQueryString)))
using (var results = searcher.Get())
{
    foreach (var item in resMg.Cast<ManagementObject>())
    {
        try
        {
            var antecedent = new ManagementObject((string)item["Antecedent"]);
            var dependent = new ManagementObject((string)item["Dependent"]);
            int procHandleInt = Convert.ToInt32(dependent["Handle"]);
            ProcInfo pI = new ProcInfo { Handle = procHandleInt, FileProc = new FileInfo((string)dependent["Name"]) };
            if (!procsMods.ContainsKey(procHandleInt))
            {
                procsMods.Add(procHandleInt, pI);
            }
            procsMods[procHandleInt].Modules.Add(new ModInfo { FileMod = new FileInfo((string)antecedent["Name"]) });
        }
        catch (System.Management.ManagementException ex)
        {
            // Process does not exist anymore
        }
    }
}

In procsMods we have stored processes and modules, now we print them:

foreach (var item in procsMods)
{
    Console.WriteLine(string.Format("{0} ({1}):", item.Value.FileProc.Name, item.Key));
    foreach (var mod in item.Value.Modules)
    {
        Console.WriteLine("\t{0}", mod.FileMod.Name);
    }
}

And these are ProcInfo and ModInfo classes:

class ProcInfo
{
    public FileInfo FileProc { get; set; }
    public int Handle { get; set; }
    public List<ModInfo> Modules { get; set; }

    public ProcInfo()
    {
        Modules = new List<ModInfo>();
    }
}

class ModInfo
{
    public FileInfo FileMod { get; set; }
}

Loading the entire WMI CIM_ProcessExecutable is a notable performance hit, there must be a way to query just by the process without iterating the entire table in c#. — Wobbles, May 30 '17 at 14:03
@Wobbles We can try with a query like `REFERENCES OF {Win32_Process.Handle=} Where ResultClass = CIM_ProcessExecutable` — Matteo Umili, May 30 '17 at 15:32
Been trying a statement like that but am getting `System.Management.ManagementException: 'Invalid object path'`. My ? : https://stackoverflow.com/questions/44264224/how-do-i-filter-a-wmi-search-on-what-i-think-is-a-nested-property — Wobbles, May 30 '17 at 19:28

score 0 · Answer 2 · answered Oct 21 '15 at 14:47

0

You have to compile you app with x64 target.

Otherwise you can consult: http://www.codeproject.com/Articles/301/Display-Loaded-Modules-v

answered Oct 21 '15 at 14:47

EC DeV

11
3

List of DLLs loaded by specific process by its name

2 Answers2

Linked

Related