ASM Community

Am getting error message 'Access Denied' while accessing module informations of some specific process (for eg: zlclient, vsmon etc). Below is code snippet to get better idea.

invoke GetCurrentProcess                           
mov        hProcess, eax                               
invoke OpenProcessToken, hProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, addr hToken
lea          eax, tkp.Privileges[0].Luid
invoke LookupPrivilegeValue, NULL, SADD("SeDebugPrivilege"), eax
mov        tkp.PrivilegeCount, 1
mov        tkp.Privileges[0].Attributes, SE_PRIVILEGE_ENABLED
invoke AdjustTokenPrivileges, hToken, FALSE, addr tkp, sizeof tkp, NULL, NULL
invoke CloseHandle, hToken

invoke CreateToolhelp32Snapshot, TH32CS_SNAPALL, 0
mov hSnapShot, eax


mov process.dwSize, sizeof PROCESSENTRY32
invoke Process32First, hSnapShot, ADDR process
mov module.dwSize, sizeof module

.while eax
invoke CreateToolhelp32Snapshot, TH32CS_SNAPMODULE, process.th32ProcessID
mov hSnapShot2, eax
.if eax ==  INVALID_HANDLE_VALUE
invoke MessageBox, 0, ADDR process.szExeFile, 0, 0
; invoke GetLastError
; invoke FormatMessage, FORMAT_MESSAGE_FROM_SYSTEM ...
.endif
invoke  Process32Next, hSnapShot, ADDR process     
.endw

please help me to sort out.

thank you.

Yes, that works fine to just enumerate the heap or module state for the current processes by specifying the
TH32CS_SNAPALL value and the current process. Then, for each process in the snapshot that is not the current process,
you have to call CreateToolhelp32Snapshot again, specifying the process identifier and the TH32CS_SNAPHEAPLIST or
TH32CS_SNAPMODULE value. Since TH32CS_SNAPHEAPLIST and TH32CS_SNAPMODULE values are process specific.