OVALProject/Sandbox — Issue #14: add the ability to query loaded modules in the win-def:process58_test
Author: djhaynes
Created: 2012-03-05 14:43:32+00:00
State: open

Need to be able to enumerate Loaded Modules associated with a process
- Access to modules as PE files - EnumProcessModules()

Get the module name with GetModuleFileNameEx Function (http://msdn.microsoft.com/en-us/library/ms683198(v=vs.85).aspx).

Please see slide 11 of the slides attached to the following oval-developer-list post.

http://making-security-measurable.1364806.n2.nabble.com/Developer-Days-Artifact-Hunting-Slides-tp6463048p6463048.html