DLL auf inject prüfen

$offset = ......
$wow= _MEMORYOPEN($ProcessID)
$base = _MEMORYMODULEGETBASEADDRESS($ProcessID, "Wow.exe")
If _MEMORYREAD($base + $offset, $wow, "byte") == XXX Then

ConsoleWrite(CheckForModule(WinGetProcess('vlc'), 'Kernel32.dll')&@CRLF)

Func CheckForModule($pid, $module_name)
	$struct = DllStructCreate('int; int; int; int; int; ptr; int; hwnd; char[256]; char[260];')
	DllStructSetData($struct, 1, DllStructGetSize($struct))
	$snapshot = DllCall('kernel32.dll', 'hwnd', 'CreateToolhelp32Snapshot', 'dword', 8, 'dword', $pid)
	DllCall('kernel32.dll', 'int', 'Module32First', 'hwnd', $snapshot[0], 'ptr', DllStructGetPtr($struct))
	Do
		If DllStructGetData($struct, 9) = $module_name Then Return True
		$module = DllCall('kernel32.dll', 'int', 'Module32Next', 'hwnd', $snapshot[0], 'ptr', DllStructGetPtr($struct))
	Until Not $module[0]
	Return False
EndFunc

#Include <WinAPI.au3>
#include <Array.au3>

; #FUNCTION#;===============================================================================
;
; Name...........: _ProcessGetLoadedModules
; Description ...: Returns an array containing the full path of the loaded modules
; Syntax.........: _ProcessGetLoadedModules($iPID)
; Parameters ....:
; Return values .: Success - An array with all the paths
;               : Failure - -1 and @error=1 if the specified process couldn't be opened.
; Author ........: Andreas Karlsson (monoceres)
; Modified.......:
; Remarks .......:
; Related .......:
; Link ..........;
; Example .......; No
;
;;==========================================================================================
Func _ProcessGetLoadedModules($iPID)
    Local Const $PROCESS_QUERY_INFORMATION=0x0400
    Local Const $PROCESS_VM_READ=0x0010
    Local $aCall, $hPsapi=DllOpen("Psapi.dll")
    Local $hProcess, $tModulesStruct
    $tModulesStruct=DllStructCreate("int [1000]")
    $hProcess=_WinAPI_OpenProcess(BitOR($PROCESS_QUERY_INFORMATION,$PROCESS_VM_READ),False,$iPID)
    If Not $hProcess Then Return SetError(1,0,-1)
    $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",1000,"dword*","")
    If $aCall[4]>1000 Then
        $tModulesStruct=DllStructCreate("int ["&$aCall[4]&"]")
        $aCall=DllCall($hPsapi,"int","EnumProcessModules","ptr",$hProcess,"ptr",DllStructGetPtr($tModulesStruct),"dword",$aCall[4],"dword*","")
    EndIf
    Local $aReturn[$aCall[4]]
    For $i=0 To Ubound($aReturn)-1
        $aCall=DllCall($hPsapi,"dword","GetModuleFileNameExW","ptr",$hProcess,"int",DllStructGetData($tModulesStruct,1,$i+1),"wstr","","dword",65536)
        $aReturn[$i]=$aCall[3]
    Next
    _WinAPI_CloseHandle($hProcess)
    DllClose($hPsapi)
    Return $aReturn
EndFunc

$MODULES = _ProcessGetLoadedModules(4920)
_ArrayDisplay($MODULES)