Module: Ocran::LibraryDetector

Extended by:
Fiddle::Importer
Includes:
Fiddle::Win32Types
Defined in:
lib/ocran/library_detector.rb

Constant Summary collapse

MAX_PATH =

Windows API functions for handling files may return long paths, with a maximum character limit of 32,767. “\?" prefix(4 characters) + long path(32762 characters) + NULL = 32767 characters learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation

32767
DEFAULT_HMODULE_BUFFER_SIZE =

The byte size of the buffer given as an argument to the EnumProcessModules function. This buffer is used to store the handles of the loaded modules. If the buffer size is smaller than the number of loaded modules, it will automatically increase the buffer size and call the EnumProcessModules function again. Increasing the initial buffer size can reduce the number of iterations required. learn.microsoft.com/en-us/windows/win32/psapi/enumerating-all-modules-for-a-process

1024

Class Method Summary collapse

Class Method Details

.loaded_dllsObject



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# File 'lib/ocran/library_detector.rb', line 35

def loaded_dlls
  dword = "L" # A DWORD is a 32-bit unsigned integer.
  bytes_needed = [0].pack(dword)
  bytes = DEFAULT_HMODULE_BUFFER_SIZE
  process_handle = GetCurrentProcess()
  handles = while true
              buffer = "\x00" * bytes
              if EnumProcessModules(process_handle, buffer, buffer.bytesize, bytes_needed) == 0
                raise "EnumProcessModules failed with error code #{GetLastError()}"
              end
              bytes = bytes_needed.unpack1(dword)
              if bytes <= buffer.bytesize
                break buffer.unpack("J#{bytes / Fiddle::SIZEOF_VOIDP}")
              end
            end
  str = "\x00".encode("UTF-16LE") * MAX_PATH
  handles.map do |handle|
    length = GetModuleFileNameW(handle, str, str.bytesize)
    if length == 0
      raise "GetModuleFileNameW failed with error code #{GetLastError()}"
    end
    str[0, length].encode("UTF-8")
  end
end