parameters: (self)
docstring: Populates the snapshot with loaded modules.
docstring_summary: Populates the snapshot with loaded modules.
docstring_tokens: Populates the snapshot with loaded modules .
function: def scan_modules(self):
          """
          Populates the snapshot with loaded modules.
          """
  
          # The module filenames may be spoofed by malware,
          # since this information resides in usermode space.
          # See: http://www.ragestorm.net/blogs/?p=163
  
          # Ignore special process IDs.
          # PID 0: System Idle Process. Also has a special meaning to the
          #        toolhelp APIs (current process).
          # PID 4: System Integrity Group. See this forum post for more info:
          #        http://tinyurl.com/ycza8jo
          #        (points to social.technet.microsoft.com)
          #        Only on XP and above
          # PID 8: System (?) only in Windows 2000 and below AFAIK.
          #        It's probably the same as PID 4 in XP and above.
          dwProcessId = self.get_pid()
          if dwProcessId in (0, 4, 8):
              return
  
          # It would seem easier to clear the snapshot first.
          # But then all open handles would be closed.
          found_bases = set()
          with win32.CreateToolhelp32Snapshot(win32.TH32CS_SNAPMODULE,
                                              dwProcessId) as hSnapshot:
              me = win32.Module32First(hSnapshot)
              while me is not None:
                  lpBaseAddress = me.modBaseAddr
                  fileName      = me.szExePath    # full pathname
                  if not fileName:
                      fileName  = me.szModule     # filename only
                      if not fileName:
                          fileName = None
                  else:
                      fileName = PathOperations.native_to_win32_pathname(fileName)
                  found_bases.add(lpBaseAddress)
  ##                if not self.has_module(lpBaseAddress): # XXX triggers a scan
                  if lpBaseAddress not in self.__moduleDict:
                      aModule = Module(lpBaseAddress, fileName = fileName,
                                             SizeOfImage = me.modBaseSize,
                                             process = self)
                      self._add_module(aModule)
                  else:
                      aModule = self.get_module(lpBaseAddress)
                      if not aModule.fileName:
                          aModule.fileName    = fileName
                      if not aModule.SizeOfImage:
                          aModule.SizeOfImage = me.modBaseSize
                      if not aModule.process:
                          aModule.process     = self
                  me = win32.Module32Next(hSnapshot)
  ##        for base in self.get_module_bases(): # XXX triggers a scan
          for base in compat.keys(self.__moduleDict):
              if base not in found_bases:
                  self._del_module(base)
function_tokens: def scan_modules ( self ) : # The module filenames may be spoofed by malware, # since this information resides in usermode space. # See: http://www.ragestorm.net/blogs/?p=163 # Ignore special process IDs. # PID 0: System Idle Process. Also has a special meaning to the #        toolhelp APIs (current process). # PID 4: System Integrity Group. See this forum post for more info: #        http://tinyurl.com/ycza8jo #        (points to social.technet.microsoft.com) #        Only on XP and above # PID 8: System (?) only in Windows 2000 and below AFAIK. #        It's probably the same as PID 4 in XP and above. dwProcessId = self . get_pid ( ) if dwProcessId in ( 0 , 4 , 8 ) : return # It would seem easier to clear the snapshot first. # But then all open handles would be closed. found_bases = set ( ) with win32 . CreateToolhelp32Snapshot ( win32 . TH32CS_SNAPMODULE , dwProcessId ) as hSnapshot : me = win32 . Module32First ( hSnapshot ) while me is not None : lpBaseAddress = me . modBaseAddr fileName = me . szExePath # full pathname if not fileName : fileName = me . szModule # filename only if not fileName : fileName = None else : fileName = PathOperations . native_to_win32_pathname ( fileName ) found_bases . add ( lpBaseAddress ) ##                if not self.has_module(lpBaseAddress): # XXX triggers a scan if lpBaseAddress not in self . __moduleDict : aModule = Module ( lpBaseAddress , fileName = fileName , SizeOfImage = me . modBaseSize , process = self ) self . _add_module ( aModule ) else : aModule = self . get_module ( lpBaseAddress ) if not aModule . fileName : aModule . fileName = fileName if not aModule . SizeOfImage : aModule . SizeOfImage = me . modBaseSize if not aModule . process : aModule . process = self me = win32 . Module32Next ( hSnapshot ) ##        for base in self.get_module_bases(): # XXX triggers a scan for base in compat . keys ( self . __moduleDict ) : if base not in found_bases : self . _del_module ( base )