2012年2月11日 星期六

Module information



For windbg debug..You can use lm (list module) command  http://msdn.microsoft.com/en-us/library/windows/hardware/ff552026(v=vs.85).aspx

1: kd> lmvm nt
start             end                 module name
fffff800`02c49000 fffff800`03226000   nt         (export symbols)       ntkrnlmp.exe
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Mon Jul 13 16:40:48 2009 (4A5BC600)
    CheckSum:         0054B487
    ImageSize:        005DD000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.


If you want to implement lmvm command by dbgeng.dll.  You can try GetModuleVersionInformation.

Status = g_Symbols->GetModuleByModuleName (name,0,&index, &base);
Status =  g_Symbols2->GetModuleVersionInformation (DEBUG_ANY_ID,base, 
"\\VarFileInfo\\Translation",   (LPVOID*)&lpTranslate, sizeof(LANGANDCODEPAGE), &size);
tmps.Format ("\\StringFileInfo\\%04x%04x\\CompanyName",lpTranslate.wLanguage,lpTranslate.wCodePage );
Status =  g_Symbols2->GetModuleVersionInformation (DEBUG_ANY_ID,base, tmps, buffer, 128, &size);

沒有留言:

張貼留言