How To Get Process's Base Address With Moduleentry32?

I'm looking to do something in this example: Python - How to get the start/base address of a process?. I'm having the same issue as the person in that topic, in that the pointers

Solution 1:

Clarification: MODULEENTRY32 stores information about modules, not processes. when you call CreateToolhelp32Snapshot using TH32CS_SNAPMODULE you are getting modules loaded by the process, not processes themselves.

Instead of getting the MODULEENTRY32 in combination with EnumProcesses you can instead use CreateToolHelp32Snapshot with TH32CS_SNAPPROCESS to get a list of processes in the form of PROCESSENRTY32 structs, which also contains the process identifier.

Despite being a user with administrator privileges, you must also run the process as an administrator.

You should also ensure you're initializing your MODULEENTRY32 to {0} for proper error handling and not running into an issue of the returned value being subject to undefined behavior of uninitialized memory.

I do not know the specific cause of your issue but I have used a source code for this purpose that is very robust that may be a plug and play alternative to what you're currently using, the important snippet will follow, but the full source is available here.

defListProcessModules( ProcessID ):
    hModuleSnap = c_void_p(0)
    me32 = MODULEENTRY32()
    me32.dwSize = sizeof( MODULEENTRY32 )
    hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, ProcessID )

    ret = Module32First( hModuleSnap, pointer(me32) )
    if ret == 0 :
        print'ListProcessModules() Error on Module32First[%d]' % GetLastError()
        CloseHandle( hModuleSnap )
        returnFalsewhile ret :
        print"   MODULE NAME:     %s"%             me32.szModule 
        print"   executable     = %s"%             me32.szExePath 
        print"   process ID     = 0x%08X"%         me32.th32ProcessID 
        print"   ref count (g)  =     0x%04X"%     me32.GlblcntUsage 
        print"   ref count (p)  =     0x%04X"%     me32.ProccntUsage 
        print"   base address   = 0x%08X"%         me32.modBaseAddr 
        print"   base size      = %d"%             me32.modBaseSize 

        ret = Module32Next( hModuleSnap , pointer(me32) )

    CloseHandle( hModuleSnap )
    returnTrue