3

DetourGetContainingModule

Brian Gianforcaro edited this page 2020-08-21 18:17:51 -07:00

Table of Contents

• DetourGetContainingModule
• Definition
• Parameters
• Return value
• Related Samples

DetourGetContainingModule

Find the PE binary in a process containing a known function.

Definition

HMODULE DetourGetContainingModule(
    _In_ PVOID vpAddr
);

Parameters

pvAddr

Address of a function in the process.

Return value

Handle to the containing module or NULL if the address doesn't reside in a loaded PE binary.

Related Samples

Tryman

Overview

• Home
• Frequently Asked Questions
• Using Detours
• Interception of Binary Functions
• Payloads and DLL Import Editing
• Detouring 32-bit and 64-bit Processes
• Samples

API Reference

• Detouring Target Functions
• Finding Target Functions
• Accessing Loaded Binaries and Payloads
• Modifying Binaries
• Inserting DLLs and Payloads Into New Processes