'取进程模块地址
'Get_Pro_Mo_Ad(进程ID As Long, 模块名 As String, 返回模块大小 As Long) As UInteger
'返回模块地址，返回0 表示没有
'64只能获取64的
'32只能获取32的
#Include Once "win\tlhelp32.bi"
''CreateToolhelpSnapshot为指定的进程、进程使用的堆[HEAP]、模块[MODULE]、线程[THREAD]）建立一个快照[snapshot]
'Declare Function CreateToolhelpSnapshot Lib "kernel32.dll" Alias "CreateToolhelp32Snapshot" ( ByVal lFlags as HANDLE , ByVal lProcessID as DWord ) as  UInteger
''获得系统快照中的第一个进程的信息
'Declare Function ProcessFirst Lib "kernel32" Alias "Process32First" ( ByVal hSnapShot as UInteger , uProcess as PROCESSENTRY32 ) as UInteger
''获得系统快照中的下一个进程的信息
'Declare Function ProcessNext Lib "kernel32" Alias "Process32Next" (   ByVal hSnapShot as UInteger , uProcess as PROCESSENTRY32   ) as UInteger

Function Get_Pro_Mo_Ad(ByVal ProId as DWord, ByVal Mo as String,ByRef MoSize as DWord) as UInteger
   Dim I as Long, lPid as Long, FileName as String, TmpLong as Long
   Dim Proc as PROCESSENTRY32
   Dim hSnapshot as HANDLE
   Dim Mode as MODULEENTRY32
   Dim mSnapshot as HANDLE
   Dim lInfoSize as Long, arrInfo() as Byte, lpInfoBlock as Long, arrTemp(4) as Byte
   
   FileName = UCase(mo)
   '----------------查找进程的执行程序的路径-----------------------
   '通过模块快照，获得进程的模块快照句柄
   mSnapshot = CreateToolhelp32Snapshot(&H8, proid) 'Const TH32CS_SNAPmodule = &H8
   If mSnapshot > 0 Then
      Mode.dwSize = SizeOf(MODULEENTRY32) '初始化结构mo的大小
      
      '用该进程第1个模块的szExePath字段，作为进程的程序路径
      If Module32First(mSnapshot, @Mode) And UCase(Proc.szExeFile) <> "[SYSTEM PROCESS]" Then
         'Print Mode.szModule
         If UCase(Mode.szModule) = FileName Then '将加载模块的路径加入ListBox
            '进程的执行程序的路径
            
            Function = Cast(UInteger, Mode.modBaseAddr)
            MoSize = Mode.modBaseSize
         Else
            Do While Module32Next(mSnapshot, @Mode) <> 0
               i += 1
               'Print i & "," & Mode.szModule
               If UCase(Mode.szModule) = FileName Then '将加载模块的路径加入ListBox
                  '进程的执行程序的路径
                  Function = Cast(UInteger, Mode.modBaseAddr)
                  MoSize = Mode.modBaseSize
                  Exit Do
               End If
            Loop 'Until Module32Next(mSnapshot, Mode) = 0
         End If
         
      End If
      CloseHandle(mSnapshot)   '关闭模块快照句柄
   End If
   
   ''    Mode.hModule 模块地址
End Function
'   Type PROCESSENTRY32 Dword
'   dwSize              As Dword                ' DWORD
'   cntUsage            As Dword                ' DWORD
'   th32ProcessID       As Dword                ' DWORD // this process
'   th32DefaultHeapID   As Dword                ' ULONG_PTR
'   th32ModuleID        As Dword                ' DWORD // associated exe
'   cntThreads          As Dword                ' DWORD
'   th32ParentProcessID As Dword                ' DWORD // this process's parent process
'   pcPriClassBase      As Long                 ' LONG // Base priority of process's threads
'   dwFlags             As Dword                ' DWORD
'   szExeFile           As Asciiz * 512   ' CHAR[MAX_PATH]
'End Type
'Type MODULEENTRY32 Dword
'   dwSize        As Dword                             ' DWORD
'   th32ModuleID  As Dword                             ' DWORD // This module
'   th32ProcessID As Dword                             ' DWORD // owning process
'   GlblcntUsage  As Dword                             ' DWORD // Global usage count on the module
'   ProccntUsage  As Dword                             ' DWORD // Module usage count in th32ProcessID's context
'   modBaseAddr   As Byte Ptr                          ' BYTE * // Base address of module in th32ProcessID's context
'   modBaseSize   As Dword                             ' DWORD // Size in bytes of module starting at modBaseAddr
'   hModule       As Dword                             ' DWORD // The hModule of this module in th32ProcessID's context
'   szModule      As Asciiz * 257   ' char[MAX_MODULE_NAME32 + 1]
'   szExePath     As Asciiz * 512                ' char[MAX_PATH]
'End Type
''======================用于查找进程和终止进程的API函数常数定义================ =====

