Получить список модулей 64-битного процесса из 32-битной программы

#include <Windows.h>
#include <winternl.h>
 
typedef NTSTATUS(NTAPI *fnNtWow64QueryInformationProcess64)(HANDLE Handle, _PROCESSINFOCLASS InfoClass, PVOID Information, ULONG InformationLength, PULONG ReturnLength);
typedef NTSTATUS(NTAPI *fnNtWow64ReadVirtualMemory64)(HANDLE Handle, ULONGLONG BaseAddress, PVOID Buffer, ULONGLONG Length, PULONGLONG ReturnLength);
 
template <typename T>
struct _LIST_ENTRY_T {
    T Flink;
    T Blink;
};
 
template <typename T>
struct _UNICODE_STRING_T {
    using type = T;
 
    uint16_t Length;
    uint16_t MaximumLength;
    T Buffer;
};
 
template<typename T>
struct _PEB_T {
    uint8_t InheritedAddressSpace;
    uint8_t ReadImageFileExecOptions;
    uint8_t BeingDebugged;
    union {
        uint8_t BitField;
        struct {
            uint8_t ImageUsesLargePages : 1;
            uint8_t IsProtectedProcess : 1;
            uint8_t IsImageDynamicallyRelocated : 1;
            uint8_t SkipPatchingUser32Forwarders : 1;
            uint8_t IsPackagedProcess : 1;
            uint8_t IsAppContainer : 1;
            uint8_t IsProtectedProcessLight : 1;
            uint8_t SpareBits : 1;
        };
    };
    T Mutant;
    T ImageBaseAddress;
    T Ldr;
    //incomplete
};
 
template<typename T>
struct _PROCESS_BASIC_INFORMATION_T {
    NTSTATUS ExitStatus;
    uint32_t    Reserved0;
    T        PebBaseAddress;
    T        AffinityMask;
    LONG     BasePriority;
    ULONG    Reserved1;
    T        uUniqueProcessId;
    T        uInheritedFromUniqueProcessId;
};
 
template<typename T>
struct _PEB_LDR_DATA2_T {
    uint32_t Length;
    uint8_t Initialized;
    T SsHandle;
    _LIST_ENTRY_T<T> InLoadOrderModuleList;
    _LIST_ENTRY_T<T> InMemoryOrderModuleList;
    _LIST_ENTRY_T<T> InInitializationOrderModuleList;
    T EntryInProgress;
    uint8_t ShutdownInProgress;
    T ShutdownThreadId;
};
 
template<typename T>
struct _LDR_DATA_TABLE_ENTRY_BASE_T {
    _LIST_ENTRY_T<T> InLoadOrderLinks;
    _LIST_ENTRY_T<T> InMemoryOrderLinks;
    _LIST_ENTRY_T<T> InInitializationOrderLinks;
    T DllBase;
    T EntryPoint;
    uint32_t SizeOfImage;
    _UNICODE_STRING_T<T> FullDllName;
    _UNICODE_STRING_T<T> BaseDllName;
    uint32_t Flags;
    uint16_t LoadCount;
    uint16_t TlsIndex;
    _LIST_ENTRY_T<T> HashLinks;
    uint32_t TimeDateStamp;
    T EntryPointActivationContext;
    T PatchInformation;
};
 
inline void EnsureSuccess(NTSTATUS status) {
    if (!NT_SUCCESS(status)) {
        char msg[256] = { 0 };
        sprintf_s(msg, "status 0x%08X", status);
        throw std::runtime_error(msg);
    }
}
 
int main() {
    _PROCESS_BASIC_INFORMATION_T<uint64_t> pbi;
    _PEB_T<uint64_t> peb;
    _PEB_LDR_DATA2_T<uint64_t> ldr;
    _LDR_DATA_TABLE_ENTRY_BASE_T<uint64_t> imageEntry;
 
    ULONG retl;
    ULONGLONG unused;
 
    auto ntdll = GetModuleHandleA("ntdll.dll");
    auto NtWow64QueryInformationProcess64 = reinterpret_cast<fnNtWow64QueryInformationProcess64>(GetProcAddress(ntdll, "NtWow64QueryInformationProcess64"));
    auto NtWow64ReadVirtualMemory64 = reinterpret_cast<fnNtWow64ReadVirtualMemory64>(GetProcAddress(ntdll, "NtWow64ReadVirtualMemory64"));
 
    auto handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 8052);
    auto status = NtWow64QueryInformationProcess64(handle, ProcessBasicInformation, &pbi, sizeof(pbi), &retl);
 
    EnsureSuccess(NtWow64ReadVirtualMemory64(handle, pbi.PebBaseAddress, &peb, sizeof(peb), &unused));
    EnsureSuccess(NtWow64ReadVirtualMemory64(handle, peb.Ldr, &ldr, sizeof(ldr), &unused));
    EnsureSuccess(NtWow64ReadVirtualMemory64(handle, ldr.InLoadOrderModuleList.Flink, &imageEntry, sizeof(imageEntry), &unused));
    
    do {
        wchar_t imageName[256] = { 0 };
        EnsureSuccess(NtWow64ReadVirtualMemory64(handle, imageEntry.BaseDllName.Buffer, imageName, sizeof(imageName), &unused));
        printf_s("module %ls base 0x%016llX\n", imageName, imageEntry.DllBase);
        EnsureSuccess(NtWow64ReadVirtualMemory64(handle, imageEntry.InLoadOrderLinks.Flink, &imageEntry, sizeof(imageEntry), &unused));
    } while (imageEntry.InLoadOrderLinks.Flink != ldr.InLoadOrderModuleList.Flink);
 
    std::getchar();
 
    return 0;
}