/*

  DLL OCCURENCY FINDER UTILITY
  it simply searches in all running process for <DLL_NAME> occurency.

  Very useful with malware detecting/removing. Imagine you
  find a dll which you can't delete and you need to know
  which process is running it...

  coded by Piotr Bania <bania.piotr@gmail.com>

  Sample usage:

   E:\projekty\finddll\Debug>finddll jar50.dll

  ....
  [+] Searching in ping.exe (PID=0x564) for module occurency.
  [+] Searching in firefox.exe (PID=0xFC4) for module occurency.

  [*] --- MODULE OCCURENCY FOUND ---
  [+] jar50.dll found in firefox.exe (PID=0xFC4)
  [+] jar50.dll base located at: 0x023c0000
  [+] jar50.dll handle in process: 0x23C0000
  [+] jar50.dll size of module: 0xD000 bytes
  [+] jar50.dll path: C:\Program Files\Mozilla Firefox\components\jar50.dll
  [*] --- PRESS ANY KEY TO CONTINUE ---
  ....

*/

#include <stdio.h>
#include <stdlib.h>
#include <conio.h>
#include <windows.h>
#include <Tlhelp32.h>

int		find_dll(char *filename);
void		display_info(PROCESSENTRY32 pe32,MODULEENTRY32 me32);

int		c=0;

int main(int argc, char *argv[]) {


	printf("[$] dll occurency finder utility \n");
	printf("[$] coded by Piotr Bania <bania.piotr@gmail.com\n\n");
	if (argc!=2) {
		printf("[!] Usage: %s <dll_name>\n",argv[0]);
		printf("[!] For example: %s KERNEL32.DLL\n",argv[0]);
		return 0;
	}
		
	find_dll(argv[1]);

	printf("\n[+] Scaning ended, found %d occurences.\n",c);
	printf("Bye :)\n");
	getch();

	return 0;
}


void display_info(char *filename,PROCESSENTRY32 pe32,MODULEENTRY32 me32) {
	

	printf("\n[*] --- MODULE OCCURENCY FOUND ---\n");
	printf("[+] %s found in %s (PID=0x%X)\n",filename,pe32.szExeFile,pe32.th32ProcessID);
	printf("[+] %s base located at: 0x%08x\n",filename,me32.modBaseAddr);
	printf("[+] %s handle in process: 0x%X\n",filename,me32.hModule);
	printf("[+] %s size of module: 0x%X bytes\n",filename,me32.modBaseSize);
	printf("[+] %s path: %s\n",filename,me32.szExePath);
	printf("[*] --- PRESS ANY KEY TO CONTINUE ---\n\n");
	c++;

	// super pseudo randomization fatal exit *:)*
	if (getch()==27) exit(GetTickCount());
}



int find_dll(char *filename) {
	HANDLE hSnap,hMSnap;
	PROCESSENTRY32 pe32;
	MODULEENTRY32 me32;

	hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
	
	if (hSnap==INVALID_HANDLE_VALUE) {
		printf("[!] Error: Cannot create snapshot for processes, error=%d\n",GetLastError());
		return FALSE;
	} 

	printf("[+] Snapshot for processes created, handle=0x%X\n",hSnap);
	
	if (Process32First(hSnap,&pe32)==FALSE) {
	    printf("[!] Error: Process32First() failed, error=%d\n",GetLastError());
		return FALSE;
	}

	hMSnap=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pe32.th32ProcessID);
	if (hMSnap==INVALID_HANDLE_VALUE) {
		printf("[!] Error: Cannot create snapshot for modules, error=%d\n",GetLastError());
		return FALSE;
	}
	
	printf("[+] Searching in %s (PID=0x%X) for module occurency.\n",pe32.szExeFile,pe32.th32ProcessID);
	if (Module32First(hMSnap,&me32)==NULL) {
		printf("[!] Error: Module32First() failed, error=%d\n",GetLastError());
		return FALSE;
	}
		

	if (!strcmpi(filename,me32.szModule)) display_info(filename,pe32,me32);
	while(Module32Next(hMSnap,&me32)!=FALSE) {
		if (!strcmpi(filename,me32.szModule)) display_info(filename,pe32,me32);
	}
	CloseHandle(hMSnap);
	//printf("\nNext process\n");

	while(Process32Next(hSnap,&pe32)!=NULL) {
		hMSnap=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pe32.th32ProcessID);
		if (hMSnap==INVALID_HANDLE_VALUE) {
			printf("[!] Error: Cannot create modules snapshot for %s (PID=0x%X), error=%d\n",pe32.szExeFile,pe32.th32ProcessID,GetLastError());
			goto next_process;
		}
			
		printf("[+] Searching in %s (PID=0x%X) for module occurency.\n",pe32.szExeFile,pe32.th32ProcessID);
		if (Module32First(hMSnap,&me32)!=NULL) {
			if (!strcmpi(filename,me32.szModule)) display_info(filename,pe32,me32);
				while(Module32Next(hMSnap,&me32)!=FALSE) {
					if (!strcmpi(filename,me32.szModule)) display_info(filename,pe32,me32);
				}
			next_process:
			CloseHandle(hMSnap);
			}
		else {
			printf("[!] Error: Cannot creat snapshot for modules, error=%d\n",GetLastError());
			return FALSE;	
		}
	}					
		
	CloseHandle(hMSnap);
	CloseHandle(hSnap);
}