typedef enum _SYSTEM_INFORMATION_CLASS { 
	SystemBasicInformation, // 0 Y N 
	SystemProcessorInformation, // 1 Y N 
	SystemPerformanceInformation, // 2 Y N 
	SystemTimeOfDayInformation, // 3 Y N 
	SystemNotImplemented1, // 4 Y N 
	SystemProcessesAndThreadsInformation, // 5 Y N 
	SystemCallCounts, // 6 Y N 
	SystemConfigurationInformation, // 7 Y N 
	SystemProcessorTimes, // 8 Y N 
	SystemGlobalFlag, // 9 Y Y 
	SystemNotImplemented2, // 10 Y N 
	SystemModuleInformation, // 11 Y N 
	SystemLockInformation, // 12 Y N 
	SystemNotImplemented3, // 13 Y N 
	SystemNotImplemented4, // 14 Y N 
	SystemNotImplemented5, // 15 Y N 
	SystemHandleInformation, // 16 Y N 
	SystemObjectInformation, // 17 Y N 
	SystemPagefileInformation, // 18 Y N 
	SystemInstructionEmulationCounts, // 19 Y N 
	SystemInvalidInfoClass1, // 20 
	SystemCacheInformation, // 21 Y Y 
	SystemPoolTagInformation, // 22 Y N 
	SystemProcessorStatistics, // 23 Y N 
	SystemDpcInformation, // 24 Y Y 
	SystemNotImplemented6, // 25 Y N 
	SystemLoadImage, // 26 N Y 
	SystemUnloadImage, // 27 N Y 
	SystemTimeAdjustment, // 28 Y Y 
	SystemNotImplemented7, // 29 Y N 
	SystemNotImplemented8, // 30 Y N 
	SystemNotImplemented9, // 31 Y N 
	SystemCrashDumpInformation, // 32 Y N 
	SystemExceptionInformation, // 33 Y N 
	SystemCrashDumpStateInformation, // 34 Y Y/N 
	SystemKernelDebuggerInformation, // 35 Y N 
	SystemContextSwitchInformation, // 36 Y N 
	SystemRegistryQuotaInformation, // 37 Y Y 
	SystemLoadAndCallImage, // 38 N Y 
	SystemPrioritySeparation, // 39 N Y 
	SystemNotImplemented10, // 40 Y N 
	SystemNotImplemented11, // 41 Y N 
	SystemInvalidInfoClass2, // 42 
	SystemInvalidInfoClass3, // 43 
	SystemTimeZoneInformation, // 44 Y N 
	SystemLookasideInformation, // 45 Y N 
	SystemSetTimeSlipEvent, // 46 N Y 
	SystemCreateSession, // 47 N Y 
	SystemDeleteSession, // 48 N Y 
	SystemInvalidInfoClass4, // 49 
	SystemRangeStartInformation, // 50 Y N 
	SystemVerifierInformation, // 51 Y Y 
	SystemAddVerifier, // 52 N Y 
	SystemSessionProcessesInformation // 53 Y N 
} SYSTEM_INFORMATION_CLASS; 


typedef NTSTATUS ( __stdcall *ZWQUERYSYSTEMINFORMATION ) 
	(	IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
	IN OUT PVOID SystemInformation, 
	IN ULONG SystemInformationLength, 
	OUT PULONG ReturnLength OPTIONAL );

ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation=NULL; 


typedef struct _SYSTEM_MODULE_INFORMATION { // Information Class 11 
	ULONG Reserved[2]; 
	PVOID Base; 
	ULONG Size; 
	ULONG Flags; 
	USHORT Index; 
	USHORT Unknown; 
	USHORT LoadCount; 
	USHORT ModuleNameOffset; 
	CHAR ImageName[256]; 
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; 




NTSTATUS findModule(IN CHAR* str,OUT ULONG *moduleadd,OUT ULONG *modulesie)
{
	NTSTATUS status=STATUS_SUCCESS;
	//PVOID szbuf=ExAllocatePool(PagedPool,10) ;
	ULONG n=0;
	ULONG i=0;
	PSYSTEM_MODULE_INFORMATION module=NULL;
	PVOID pbuftmp=NULL;
	//ANSI_STRING ModuleName1,ModuleName2;
	BOOL tlgstst= FALSE;  

	status=ZwQuerySystemInformation(SystemModuleInformation, &n, 0, &n);
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！