标签 windows Xp 下的文章 - 白帽Wiki

from windows XP
```cpp
BOOL IsSvcInjected(DWORD dwPid)
{
    HANDLE hProcess;
    HMODULE hMods[1024];
    BOOL res = FALSE;

hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwPid);
    if (hProcess != NULL)
    {
        DWORD dwSize;
        // search through all loaded modules and see if we are injected 
        if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &dwSize))
        {
            DWORD n;
            for (n = 0; n < (dwSize / sizeof(HMODULE)); n++)
            {
                WCHAR   wszModName[MAX_PATH];
                if (GetModuleBaseNameW(hProcess, hMods[n], wszModName, sizeof(wszModName) / sizeof(WCHAR)))
                {
                    if (_wcsicmp(wszModName, SBIEDLL L".dll") == 0)
                    {
                        res = TRUE;
                        break;
                    }
                }
            }
        } // if (EnumProcessModules())

CloseHandle(hProcess);
    } // if (OpenProcess())

return res;
}
```

白帽Wiki

一只鸭子

白帽Wiki - 一个简单的wiki

[2021]微软的dll搜索源码