79323729

Date: 2025-01-02 12:41:59
Score: 1.5
Natty:
Report link

Actually, sddvxd's answer is the correct one, in a specific scenario, when you are trying to call EnumProcessModules[Ex] just after returning from CreateProcess with CREATE_SUSPENDED. In this scenario, the module list is not yet populated (despite the main module already being loaded), and ERROR_PARTIAL_COPY is returned.

See: https://groups.google.com/g/comp.os.ms-windows.programmer.win32/c/ZIa1BDteUKk

Reasons:
  • No code block (0.5):
  • Low reputation (1):
Posted by: Martin Mocko