Hi, i have a strange problem (becoz it works in C++ but not in asm). I want to start a Process in suspended state and after it getting its image base address. I solve this with CreateToolhelp32Snapshot and Module32First. The following code works converted to C++, but not in asm, perhaps anybody of you sees the error or has an advice for me:

mov [startup.cb],68
invoke SetCurrentDirectory,dir1
invoke CreateProcess,filename,commandline,0,0,0,CREATE_SUSPENDED,0,0,startup,procinfo
invoke CreateToolhelp32Snapshot,8,[procinfo.dwProcessId]
mov [snaphandle],eax
mov [modinf.dwSize],0x224
invoke Module32First,[snaphandle],modinf
invoke ResumeThread,[procinfo.hThread]

;The structures have this format:

.hProcess DD 0
.hThread DD 0
.dwProcessId DD 0
.dwThreadId DD 0

.dwSize DD 0 ;0x224
.th32ModuleID DD 0
.th32ProcessID DD 0
.GlblcntUsage DD 0
.ProccntUsage DD 0
.modBaseAddr DD 0
.modBaseSize DD 0
.hModule DD 0
.szModule: times 256 db 0
.szExePath: times 260 db 0

The Problem is that CreateToolhelpSnapshot seems to work and gives me
Posted on 2004-10-10 11:27:38 by belial
well, if i were you i stepped with a debugger through both the c++ version and asm version and compared the results. also check the returned stuff by the various apis, check the errorcodes and do some getlasterror()s where needed.
Posted on 2004-10-10 12:42:03 by lifewire
Mh, there was at least a little difference in my codes, i started in c++ the process not in suspended state. I dont know why, but its not possible to use Module32First and Module32Next when the main thread of the process is in suspended state.
Posted on 2004-10-10 19:02:14 by belial
have you tried PSAPI instead of TOOLHELP?
PSAPI exports EnumProcesses, EnumProcessModules, and such
if you are strictly using NT/2000/XP/2003, you can retrieve the list of loaded modules manually using ReadProcessMemory by looking up structures inside PEB
Posted on 2004-10-10 19:19:03 by comrade
I thought about that too, but i decided now to have bedder compatibility to win 9x to read out the image base from the PE header of the file.
Posted on 2004-10-11 06:49:34 by belial