James Hawkins wrote:
Maybe that only returns the hinstance of the process calling the module, and not the hinstance of the module itself.
Ofcourse it doesn't do that, how should it know from what module the call came from?
I didn't think so, so shouldn't GetModuleHandle(NULL) work? It leads me to believe there's a bug in our GetModuleHandle.
Eh? Ofcourse GetModuleHandle(NULL) works - it retrieves a handle to the calling process. This is what it does in Wine and what MSDN says about it ("If this parameter is NULL, GetModuleHandle returns a handle to the file used to create the calling process (.exe file).").
To make your code work it would have to retrieve a handle to the module in which the used call to GetModuleHandle resides - but there is no way it could know where that is since every call to the function resides at a different address.
In theory you could roll back the stack to figure out EIP when the call was made and then see what module is loaded at that address but that's not what C APIs are supposed to do. And for that matter it's not what Windows does either.
Felix