(self)
Populates the snapshot with loaded modules.
Populates the snapshot with loaded modules.
Populates the snapshot with loaded modules .
def scan_modules(self):
        """
        Populates the snapshot with loaded modules.
        """

        # The module filenames may be spoofed by malware,
        # since this information resides in usermode space.
        # See: http://www.ragestorm.net/blogs/?p=163

        # Ignore special process IDs.
        # PID 0: System Idle Process. Also has a special meaning to the
        #        toolhelp APIs (current process).
        # PID 4: System Integrity Group. See this forum post for more info:
        #        http://tinyurl.com/ycza8jo
        #        (points to social.technet.microsoft.com)
        #        Only on XP and above
        # PID 8: System (?) only in Windows 2000 and below AFAIK.
        #        It's probably the same as PID 4 in XP and above.
        dwProcessId = self.get_pid()
        if dwProcessId in (0, 4, 8):
            return

        # It would seem easier to clear the snapshot first.
        # But then all open handles would be closed.
        found_bases = set()
        with win32.CreateToolhelp32Snapshot(win32.TH32CS_SNAPMODULE,
                                            dwProcessId) as hSnapshot:
            me = win32.Module32First(hSnapshot)
            while me is not None:
                lpBaseAddress = me.modBaseAddr
                fileName      = me.szExePath    # full pathname
                if not fileName:
                    fileName  = me.szModule     # filename only
                    if not fileName:
                        fileName = None
                else:
                    fileName = PathOperations.native_to_win32_pathname(fileName)
                found_bases.add(lpBaseAddress)
##                if not self.has_module(lpBaseAddress): # XXX triggers a scan
                if lpBaseAddress not in self.__moduleDict:
                    aModule = Module(lpBaseAddress, fileName = fileName,
                                           SizeOfImage = me.modBaseSize,
                                           process = self)
                    self._add_module(aModule)
                else:
                    aModule = self.get_module(lpBaseAddress)
                    if not aModule.fileName:
                        aModule.fileName    = fileName
                    if not aModule.SizeOfImage:
                        aModule.SizeOfImage = me.modBaseSize
                    if not aModule.process:
                        aModule.process     = self
                me = win32.Module32Next(hSnapshot)
##        for base in self.get_module_bases(): # XXX triggers a scan
        for base in compat.keys(self.__moduleDict):
            if base not in found_bases:
                self._del_module(base)
def scan_modules ( self ) : # The module filenames may be spoofed by malware, # since this information resides in usermode space. # See: http://www.ragestorm.net/blogs/?p=163 # Ignore special process IDs. # PID 0: System Idle Process. Also has a special meaning to the #        toolhelp APIs (current process). # PID 4: System Integrity Group. See this forum post for more info: #        http://tinyurl.com/ycza8jo #        (points to social.technet.microsoft.com) #        Only on XP and above # PID 8: System (?) only in Windows 2000 and below AFAIK. #        It's probably the same as PID 4 in XP and above. dwProcessId = self . get_pid ( ) if dwProcessId in ( 0 , 4 , 8 ) : return # It would seem easier to clear the snapshot first. # But then all open handles would be closed. found_bases = set ( ) with win32 . CreateToolhelp32Snapshot ( win32 . TH32CS_SNAPMODULE , dwProcessId ) as hSnapshot : me = win32 . Module32First ( hSnapshot ) while me is not None : lpBaseAddress = me . modBaseAddr fileName = me . szExePath # full pathname if not fileName : fileName = me . szModule # filename only if not fileName : fileName = None else : fileName = PathOperations . native_to_win32_pathname ( fileName ) found_bases . add ( lpBaseAddress ) ##                if not self.has_module(lpBaseAddress): # XXX triggers a scan if lpBaseAddress not in self . __moduleDict : aModule = Module ( lpBaseAddress , fileName = fileName , SizeOfImage = me . modBaseSize , process = self ) self . _add_module ( aModule ) else : aModule = self . get_module ( lpBaseAddress ) if not aModule . fileName : aModule . fileName = fileName if not aModule . SizeOfImage : aModule . SizeOfImage = me . modBaseSize if not aModule . process : aModule . process = self me = win32 . Module32Next ( hSnapshot ) ##        for base in self.get_module_bases(): # XXX triggers a scan for base in compat . keys ( self . __moduleDict ) : if base not in found_bases : self . _del_module ( base )