typedef struct _SYSTEM_MODULE_INFORMATION // Information Class 11
{
ULONG Reserved[2];// +0
PVOID Base; // +08h
ULONG Size; // +0ch
ULONG Flags; // +10h
USHORT Index; // +14h
USHORT Unknown; // +16h
USHORT LoadCount; // +18h
USHORT ModuleNameOffset;/// +1Ah
CHAR ImageName[256]; // +1Ch
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
int main(int argc, char* argv[])
{
// _asm int 3
CHAR WinDir[MAX_PATH]={0};
// WCHAR drvName[]=L"\\123.txt";
// GetSystemDirectory(sysDir, MAX_PATH);
ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation;
PSYSTEM_MODULE_INFORMATION smi;
DWORD *pRet;
DWORD nRetSize;
int i;
// _asm int 3
ZwQuerySystemInformation=(ZWQUERYSYSTEMINFORMATION)GetProcAddress(LoadLibrary("ntdll.dll"),"ZwQuerySystemInformation");
ZwQuerySystemInformation(0xb,&pRet,0,&nRetSize);
pRet=(DWORD*)GlobalAlloc(GMEM_ZEROINIT,nRetSize);

ZwQuerySystemInformation(0xb,pRet,nRetSize,&nRetSize);
int n=*pRet;
smi=(PSYSTEM_MODULE_INFORMATION)((PULONG)pRet+1);
DWORD basea=(DWORD)smi;
char *p;
for(i=0;i<n;i++)
{
memset(WinDir,0,MAX_PATH);
GetWindowsDirectory(WinDir, MAX_PATH);
strlwr(smi->ImageName);
if(smi->ImageName[0]==0x5c||smi->ImageName[0]==0x3F)
{
if (smi->ImageName[1]==0x77&&
smi->ImageName[2]==0x69&&
smi->ImageName[3]==0x6E&&
smi->ImageName[4]==0x64&&
smi->ImageName[5]==0x6F)
{
p=strstr(smi->ImageName+1,"\\");
if (p)
{
strcat(WinDir,p);
}
}
else if (smi->ImageName[1]==0x3F)
{
memset(WinDir,0,MAX_PATH);
strcpy(WinDir,smi->ImageName+4);
}
else
{
p=strstr(smi->ImageName+1,"\\");
if (p)
{
strcat(WinDir,p);
}

}
}
else
{
memset(WinDir,0,MAX_PATH);
strcat(WinDir,smi->ImageName);
}
printf("0x%08X %s\n",smi->Base,WinDir);
smi=(PSYSTEM_MODULE_INFORMATION)(basea+0x11c*(i+1));
//smi++;
}

return 0;
}