Custom-GetModuleHandle

CustomGetModuleHandle Overview The CustomGetModuleHandle project demonstrates how to manually enumerate loaded modules in a Windows process using the Process Environment Block (PEB). Unlike the standard GetModuleHandleW API, this custom implementation directly accesses internal Windows structures to retrieve module information, a common technique used in malware development and anti-analysis strategies. This technique can bypass certain API hooks set by antivirus or EDR (Endpoint Detection and Response) tools, making it a valuable concept for both red team operators and malware analysts. Table of Contents Overview Purpose How It Works Requirements Installation Usage Code Explanation Disclaimer License Purpose Demonstrate manual DLL enumeration using PEB. Bypass potential hooks on standard APIs. Serve as an educational example for reverse engineers and malware analysts. How It Works Access the Process Environment Block (PEB) using architecture-specific offsets. Traverse the InMemoryOrderModuleList to enumerate loaded modules. Compare module names with the target DLL name. Return the module base address if found. Requirements Windows Operating System