[c++] GetModuleHandle(NtDll) 64Bit

char WinDir[1024];
int Length = GetWindowsDirectory(WinDir, 1024);
String NtDll = AnsiString(WinDir) + "\\System32\\NtDll.dll";
char* t1 = AnsiString(NtDll).c_str();
HANDLE NtDllHandle = GetModuleHandle(t1);

program moduletest;

uses
 SysUtils, Windows;

type
 TModuleEntry = record
   Name:        string;
   Path:        string;
   BaseSize:    integer;
   BaseAddress: integer;
   handle:      THandle;
   accessible:  boolean;
 end;

var
 ModuleList: array of TModuleEntry;

function ExtractProcessInformation(const MTarget: Integer): Boolean;
var
 Handle: THandle; // aka NativeUInt
 me32:   tagMODULEENTRY32; // aka winbase._tagMODULEENTRY32;
begin
 try
  result := false;
  Handle := CreateToolhelp32Snapshot(TH32CS_SNAPALL, MTarget);
  if not ( Handle > 0 ) then
   Exit;
  me32.dwSize := SizeOf(tagmoduleentry32);
  if not Module32First(Handle, me32) then
   Exit;

  SetLength(ModuleList, 0);
  repeat
   SetLength(ModuleList, Length(ModuleList)+1);
   ModuleList[High(ModuleList)].Name := me32.szModule;
   ModuleList[High(ModuleList)].BaseSize := me32.modBaseSize;
   ModuleList[High(ModuleList)].BaseAddress := Integer(me32.modBaseAddr);
   ModuleList[High(ModuleList)].handle := me32.hModule;
   ModuleList[High(ModuleList)].accessible := me32.hModule <> 0;
  until not Module32Next(Handle, me32);
  Result := true;
  if GetLastError = 18 then SetLastError(0); // 18 = No More Data 
 finally
  CloseHandle(Handle);
 end;
end;

begin
 if ParamCount = 2 then
  ExtractProcessInformation(IntToStr(ParamStr(1))) 
 else
  WriteLn('Usage: program.exe PID');
end.

HMODULE NtDll32;
HMODULE NtDll64;

void GetModuleHandles() {
 	char WinDir[1024];
	int Length = GetWindowsDirectory(WinDir, 1024);
	char* t1 = AnsiString(AnsiString(WinDir) + "\\system32\\ntdll.dll").c_str();
	char* t2 = AnsiString(AnsiString(WinDir) + "\\SysWOW64\\ntdll.dll").c_str();

	MODULEENTRY32 ModuleEntry;
	ModuleEntry.dwSize = sizeof(MODULEENTRY32);

	HANDLE Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
	if (Snapshot == 0) Debugger::Hacking++;
	Module32First(Snapshot, &ModuleEntry);
	do {
		if (strcmp(ModuleEntry.szExePath, t1) == 0) {
			NtDll32 = ModuleEntry.hModule;
		}
		else if (strcmp(ModuleEntry.szExePath, t2) == 0) {
			NtDll64 = ModuleEntry.hModule;
		}
	} while (Module32Next(Snapshot, &ModuleEntry));
}

#include <windows.h>
#include <psapi.h>
#pragma comment(lib, "psapi.lib")
#include <stdio.h>
#include <stdlib.h>
#include <conio.h>


// For the following function see:
//http://msdn.microsoft.com/library/en-us/fileio/fs/obtaining_a_file_name_from_a_file_handle.asp
#define BUFSIZE 512
BOOL DisplayRealFileName(LPCTSTR szFileName)
{
   HANDLE hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ | 
FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
   if (hFile == INVALID_HANDLE_VALUE)
     return FALSE;

   BOOL bSuccess = FALSE;
   TCHAR pszFilename[MAX_PATH+1];
   HANDLE hFileMap;

   // Get the file size.
   DWORD dwFileSizeHi = 0;
   DWORD dwFileSizeLo = GetFileSize(hFile, &dwFileSizeHi);

   if( dwFileSizeLo == 0 && dwFileSizeHi == 0 )
   {
      _tprintf(_T("Cannot map a file with a length of zero.\n"));
      CloseHandle(hFile);
      return FALSE;
   }

   // Create a file mapping object.
   hFileMap = CreateFileMapping(hFile,
                     NULL,
                     PAGE_READONLY,
                     0,
                     1,
                     NULL);

   if (hFileMap)
   {
     // Create a file mapping to get the file name.
     void* pMem = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);

     if (pMem)
     {
       if (GetMappedFileName (GetCurrentProcess(),
                              pMem,
                              pszFilename,
                              MAX_PATH))
       {

         // Translate path with device name to drive letters.
         TCHAR szTemp[BUFSIZE];
         szTemp[0] = '\0';

         if (GetLogicalDriveStrings(BUFSIZE-1, szTemp))
         {
           TCHAR szName[MAX_PATH];
           TCHAR szDrive[3] = TEXT(" :");
           BOOL bFound = FALSE;
           TCHAR* p = szTemp;

           do
           {
             // Copy the drive letter to the template string
             *szDrive = *p;

             // Look up each device name
             if (QueryDosDevice(szDrive, szName, BUFSIZE))
             {
               size_t uNameLen = _tcslen(szName);

               if (uNameLen < MAX_PATH)
               {
                 bFound = _tcsnicmp(pszFilename, szName,
                     uNameLen) == 0;

                 if (bFound)
                 {
                   // Reconstruct pszFilename using szTemp
                   // Replace device path with DOS path
                   TCHAR szTempFile[MAX_PATH];
                   _stprintf_s(szTempFile,
                             TEXT("%s%s"),
                             szDrive,
                             pszFilename+uNameLen);
                   _tcsncpy_s(pszFilename, szTempFile, MAX_PATH);
                 }
               }
             }

             // Go to the next NULL character.
             while (*p++);
           } while (!bFound && *p); // end of string
         }
       }
       bSuccess = TRUE;
       UnmapViewOfFile(pMem);
     }

     CloseHandle(hFileMap);
   }
   _tprintf(_T("File name is %s\n"), pszFilename);
   CloseHandle(hFile);
   return(bSuccess);
}



void PrintModules( DWORD processID )
{
   HMODULE hMods[1024];
   HANDLE hProcess;
   DWORD cbNeeded;
   unsigned int i;

   _tprintf( _T("\nProcess ID: %u\n"), processID );
   hProcess = OpenProcess(PROCESS_QUERY_INFORMATION |PROCESS_VM_READ, 
FALSE, processID);
   if (NULL == hProcess)
     return;
   if( EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
   {
     for ( i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
     {
       TCHAR szModName[MAX_PATH];
       if ( GetModuleFileNameEx( hProcess, hMods[i], szModName, 
sizeof(szModName)))
       {
         _tprintf(_T("\t%s (0x%p)\n"), szModName, hMods[i] );
         DisplayRealFileName(szModName);
       }
     }
   }
   CloseHandle( hProcess );
}


int _tmain(int argc, _TCHAR* argv[])
{
   int pprocessID = GetCurrentProcessId();
   if (argc > 1)
     pprocessID = _tstol(argv[1]);

   PrintModules(pprocessID);

   _tprintf(_T("Press any key to continue..."));
   _getch();
	return 0;
}