This is pretty simple, but you need to understand that not all processed are related to .NET. You have been close but probably missed one simple thing: assemblies are made of
modules; and a PE file represents not an assembly, but an assembly module. Moreover, even though Visual Studio does not directly support it, the assemblies can be made of more than one module, only one of them representing the assembly via its assembly manifest, main module. So, you need to filter out all other modules (which may or may not be the modules with assembly manifest) and then get to assemblies.
Armed with this understanding, you can easily dig into modules. First, you get modules of each of your process:
https://msdn.microsoft.com/en-us/library/system.diagnostics.process.modules%28v=vs.110%29.aspx[
^].
For each module, you can get its file name. Note that this is a different class from assembly
Module
. This is because
ProcessModule
has to implement all executable modules, not only .NET ones:
https://msdn.microsoft.com/en-us/library/system.diagnostics.processmodule%28v=vs.110%29.aspx[
^],
https://msdn.microsoft.com/en-us/library/system.diagnostics.processmodule.filename(v=vs.110).aspx[
^].
Now, pretend that this module is a main module of some assembly and try to interpret is like this. Be ready to handle exceptions. Even though the assembly is already loaded in that detected process, you have to load (try to load) it again, in another process: you executing process:
https://msdn.microsoft.com/en-us/library/1009fa28(v=vs.110).aspx[
^] (don't mix-up
Assembly.LoadFrom
and
Assembly.Load
; you don't need the second one).
You can load only for reflection:
https://msdn.microsoft.com/en-us/library/system.reflection.assembly.reflectiononlyloadfrom%28v=vs.110%29.aspx[
^].
Now when you get to the instance of the
System.Assembly
of some detected process (in case of successful load), you can continue your search with it:
https://msdn.microsoft.com/en-us/library/system.reflection.assembly%28v=vs.110%29.aspx[
^],
get loaded modules:
https://msdn.microsoft.com/en-us/library/4t888ytw(v=vs.110).aspx[
^],
referenced assemblies:
https://msdn.microsoft.com/en-us/library/system.reflection.assembly.getreferencedassemblies(v=vs.110).aspx[
^],
see also:
https://msdn.microsoft.com/en-us/library/43wc4hhs%28v=vs.110%29.aspx[
^].
If you really need actually
loaded assemblies, don't confuse them with
referenced assemblies. Some referenced assemblies may be not loaded, and some assembly can be loaded dynamically without referencing. So, you rather need to get to all loaded modules (see the link above, this time, these are not process modules (
ProcessModule
) but instances of
System.Reflection.Module
. Look at the assembly of each:
https://msdn.microsoft.com/en-us/library/system.reflection.module%28v=vs.110%29.aspx[
^],
https://msdn.microsoft.com/en-us/library/system.reflection.module.assembly(v=vs.110).aspx[
^].
—SA