title: GetModuleHandleA fails to get modules not used by python.exe when attached to another process
body: <p>I am working with Grey Hat Python book at the moment. It describes on how to create a debugger in python. So far my debugger is able to start the process and attach to it. The problem happens when I try to retrieve a module handle from the process. According to OllyDbg the DLL is present in the program, but <code>GetModuleHandleA</code> fails to get a handle. I improved a code from the book a little bit so in case <code>GetModuleHandleA</code> fails to retrieve a handle the function will try to create a remote thread and force to load this module into the process. But even so it <code>GetModuleHandleA</code> fails (while everything else works fine). So maybe someone can take a quick glance at the code and see the problem in it?</p>
  
  <pre><code>def func_resolve(self,dll,function):
      handle  = kernel32.GetModuleHandleA(dll)
      print "%s module handle is at 0x%08x" % (dll, handle)
      error = kernel32.GetLastError()
      if error:
          print "There was an error in func_resolve::GetModuleHandleA(%s): %d" % (dll, error)
          print "Loading library into the process"
          pLibRemote = kernel32.VirtualAllocEx(self.h_process, 0, len(dll), 0x00001000, 0x04)
          print "Allocated %d bytes of memory at 0x%08x" % (len(dll), pLibRemote)
          written = c_int(0)
          kernel32.WriteProcessMemory(self.h_process, pLibRemote, dll, len(dll), byref(written))
          print "Written %d bytes" % written.value
          handle  = kernel32.GetModuleHandleA("kernel32.dll")
          print "Kernel module handle is 0x%08x" % handle
          address = kernel32.GetProcAddress(handle, "LoadLibraryA")
          print "LoadLibraryA address is 0x%08x" % address
          thread_id = c_ulong(0)
          kernel32.CreateRemoteThread(self.h_process, None, 0, address, pLibRemote, 0, byref(thread_id))
          print "Created thread %d" % thread_id.value
      handle  = kernel32.GetModuleHandleA(dll)
      address = kernel32.GetProcAddress(handle, function)
      kernel32.CloseHandle(handle)
      return address
  </code></pre>
  
  <p>The output looks like this:</p>
  
  <pre><code>[*] We have successfully launched the process!
  [*] The Process ID I have is: 10380
  Proces handle is 228
  opengl32.dll module handle is at 0x00000000
  There was an error in func_resolve::GetModuleHandleA(opengl32.dll): 126
  Loading library into the process
  Allocated 12 bytes of memory at 0x002c0000
  Written 12 bytes
  Kernel module handle is 0x772c0000
  LoadLibraryA address is 0x772d498f
  Created thread 11136
  [*] Address of func: 0x00000000
  [*] Setting breakpoint at: 0x00000000
  </code></pre>
  
  <p>The module handle is retrieved fine if it is used by python.exe (is among the imported list of python.exe process). But modules that are not in python.exe processes fail. Maybe that could be related somehow to OS Windows 7 (64 bit), but still application that I test against was compiled with a 32 bit compiler.</p>
  
  <p>Update 2: According to recommendation in comments I wrote my own function:</p>
  
  <pre><code>def my_func_resolve(self, dll, function):
      module32 = MODULEENTRY32()
      CreateToolhelp32Snapshot = kernel32.CreateToolhelp32Snapshot
      CreateToolhelp32Snapshot.restype = HANDLE
      CreateToolhelp32Snapshot.argtypes = [DWORD, DWORD]
      Module32First = kernel32.Module32First
      Module32First.restype = BOOL
      Module32First.argtypes = [HANDLE, POINTER(MODULEENTRY32)]
      Module32Next = kernel32.Module32Next
      Module32Next.restype = BOOL
      Module32Next.argtypes = [HANDLE, POINTER(MODULEENTRY32)]
      thandle = 24
      while thandle == 24:
          thandle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, self.pid)
      if thandle == 0 or thandle == 0xFFFFFFFF:
          print "Failed to create a snapshot. Error: %d" % kernel32.GetLastError()
          exit()
      if not Module32First(thandle, byref(module32)):
          print "Module32First failed. Error: %d" % kernel32.GetLastError()
          kernel32.CloseHandle(thandle)
          exit()
      while module32:
          print "DLL %s is loaded at 0x%08x" % (module32.szModule, module32.modBaseAddr)
          Module32Next(thandle, byref(module32))
      kernel32.CloseHandle(thandle)
      return True
  </code></pre>
  
  <p>but it fails with</p>
  
  <pre><code>[*] We have successfully launched the process!
  [*] The Process ID I have is: 9584
  Proces handle is 228
  Failed create snapshot. Error: 299
  </code></pre>
  
  <p>Which is ERROR_PARTIAL_COPY and happens if we are trying to retrieve 64 bit process from 32 bit process. I have 32 bit python. My OS is 64 bit. I compiled testprog.exe using mingw 32 bit compiler. How that happened that I get this error now?
  For <code>TH32CS_SNAPMODULE</code> I used both <code>0x00000008</code> and <code>0x00000010</code></p>
  
  <p>Just in case, the process is created in this way:</p>
  
  <pre><code>if kernel32.CreateProcessA(path_to_exe,
                              None,
                              None,
                              None,
                              None,
                              creation_flags,
                              None,
                              None,
                              byref(startupinfo),
                              byref(process_information)):
      print "[*] We have successfully launched the process!"
      print "[*] The Process ID I have is: %d" % \
                      process_information.dwProcessId
      self.pid = process_information.dwProcessId
      self.h_process = self.open_process(process_information.dwProcessId)
      print "Proces handle is %d" % self.h_process
  </code></pre>