How do I read the PE header of a module loaded in memory?

Question

I'm experimenting with memory access in .NET. At the moment, I have a managed program that starts an unmanaged process and retrieves the BaseAddress of one of its loaded modules (a DLL). What I would like to do is somehow read the PE header of the loaded module so that I can later retrieve the addresses of its exports.

Unfortunately, I can't find any good information about this. Any ideas?

Answer 1

This is a good starting point for the PE file format.

You can P/Invoke ReadProcessMemory from the base address you have to copy the headers into your process. You'll need to parse the memory you read into the various PE headers. The first header is the IMAGE_DOS_HEADER, which will point you to the IMAGE_NT_HEADERS. You can then use the IMAGE_OPTIONAL_HEADER in the IMAGE_NT_HEADERS to find the location of the IMAGE_EXPORT_DIRECTORY in the binary.