function GetModulePreferredBaseAddr(dwProcessID:DWORd;pvModuleRemote:Pointer):dword;stdcall;
var
idh:pIMAGEDOSHEADER;
inth:pIMAGENTHEADERS;
cbread:dword;
lpread:dword;
begin
result:=0;
idh:=nil;
inth:=nil;
cbread:=0;
lpread:=0;
Toolhelp32ReadProcessMemory(dwProcessID,pvModuleRemote,idh^,cbread ,lpread);
if idh.e_magic=IMAGE_DOS_SIGNATURE then begin
Toolhelp32ReadProcessMemory(dwProcessID,pointer(integer(pvModuleRemote)+idh._lfanew),inth,cbread,lpread);
if inth.Signature=IMAGE_NT_SIGNATURE then begin
result:=inth.OptionalHeader.ImageBase;
end;
end;
end;
