FS_Process_Modules

The modules per-process directory

The directory modules exists as a sub-directory in each process directory.

The modules directory contains one sub-directory for each loaded module (.DLLs and EXEs)

For kernel "processes" such as the System process in Windows (PID 4) the directory will contain loaded drivers (.SYS-files and .DLLs)

Each module directory contains a number of informational files and directories related to the loaded module. The files and directories and their contents are listed below:

• base: base virtual address of the module.
• directories: information about the 16 data directories in the PE/MZ header.
• entry: entry point virtual address of the module.
• export: functions exported by the module.
• import: functions imported by the module and their corresponding modules.
• pefile.dll: best-effort reconstructed module, .exe/.dll/.sys, file from memory fragments.
• sections: sections of the module.
• size: size of the module.
• directoriesd: directory containing a file for each of the 16 data directories.
• sectionsd: directory containing a file for each section.

Files in the individual module directories are read-only. pefile.dll and files in the directoriesd and sectionsd sub-directories are writable if a write-capable memory acquisition device is used.

File: sections

The file sections contains information about the module PE sections.

The meaning of the different columns (please see sample file below) are as follows: number / name / memory address / offset from module base / size / page permissions / file offset / file size

00 .text     00007ff7959a1000 00001000 0002e338 r-x 00000400 0002e400
...
05 .rsrc     00007ff7959fb000 0005b000 000084f8 r-- 0003b600 00008600
06 .reloc    00007ff795a04000 00064000 00000308 r-- 00043c00 00000400

Example

The example below shows the files in the modules/Actioncenter.dll sub-directory of the explorer.exe process. All files are related to the Actioncenter.dll module which is loaded into the explorer.exe process.

Shown in Notepad++ are the sections of the .DLL. While Ubuntu shows the entry, size, exported functions and the three first imported functions.

For Developers

The modules sub-directory is implemented as a built-in native C-code plugin. The plugin source is located in the file m_ldrmodules.c in the vmm project. The plugin contains limited caching functionality that will allow it to cache generated listings of the export and import address tables.