From b1b24fa209ca13dce58cb214070f17e92275799a Mon Sep 17 00:00:00 2001
From: vxunderground <57078196+vxunderground@users.noreply.github.com>
Date: Thu, 14 Jul 2022 22:59:21 -0500
Subject: [PATCH] Create GetInMemoryModulePathFromLoaderLoadModule.cpp

---
 ...InMemoryModulePathFromLoaderLoadModule.cpp | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 Windows API/GetInMemoryModulePathFromLoaderLoadModule.cpp

diff --git a/Windows API/GetInMemoryModulePathFromLoaderLoadModule.cpp b/Windows API/GetInMemoryModulePathFromLoaderLoadModule.cpp
new file mode 100644
index 0000000..8361628
--- /dev/null
+++ b/Windows API/GetInMemoryModulePathFromLoaderLoadModule.cpp	
@@ -0,0 +1,26 @@
+DWORD GetInMemoryModulePathFromLoaderLoadModuleA(DWORD nBufferLength, PCHAR lpBuffer)
+{
+	PPEB Peb = GetPeb();
+	PLDR_MODULE Module = NULL;
+	Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
+
+	if (nBufferLength < Module->FullDllName.Length)
+		return ERROR_FAILURE_RETURN;
+
+	return (DWORD)WCharStringToCharString(lpBuffer, Module->FullDllName.Buffer, Module->FullDllName.MaximumLength);
+}
+
+DWORD GetInMemoryModulePathFromLoaderLoadModuleW(DWORD nBufferLength, PWCHAR lpBuffer)
+{
+	PPEB Peb = GetPeb();
+	PLDR_MODULE Module = NULL;
+	Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
+
+	if(nBufferLength < Module->FullDllName.Length)
+		return ERROR_FAILURE_RETURN;
+
+	if (StringCopyW(lpBuffer, Module->FullDllName.Buffer) == NULL)
+		return ERROR_FAILURE_RETURN;
+
+	return Module->FullDllName.Length;
+}