dump: added WOW64 module information

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2456 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2026-06-08 16:03:24 +00:00 · 2009-12-18 10:55:51 +00:00
parent c68bbb17d0
commit 43f3274be2
1 changed files with 24 additions and 0 deletions
@@ -488,8 +488,13 @@ namespace ProcessHacker
            {
                if (pid != 4)
                {
+                    bool isWow64 = false;
+
                    using (var phandle = new ProcessHandle(pid, Program.MinProcessQueryRights | ProcessAccess.VmRead))
                    {
+                        if (OSVersion.Architecture == OSArch.Amd64)
+                            isWow64 = phandle.IsWow64();
+
                        phandle.EnumModules((module) =>
                            {
                                DumpProcessModule(modules, module);
@@ -516,6 +521,25 @@ namespace ProcessHacker
                                return true;
                            });
                    }
+
+                    if (isWow64)
+                    {
+                        try
+                        {
+                            using (var buffer = new ProcessHacker.Native.Debugging.DebugBuffer())
+                            {
+                                buffer.Query(pid, RtlQueryProcessDebugFlags.Modules32);
+
+                                buffer.EnumModules((module) =>
+                                    {
+                                        DumpProcessModule(modules, module);
+                                        return true;
+                                    });
+                            }
+                        }
+                        catch
+                        { }
+                    }
                }
                else
                {