NTSTATUS nStatus = STATUS_SUCCESS;
ULONG ulBytes = 0;
PRTL_PROCESS_MODULES pMods = nullptr;
std::unique_ptr<char[]> pBuffers = nullptr;
do
{
nStatus = ZwQuerySystemInformation(SystemModuleInformation, 0, ulBytes, &ulBytes);
if (ulBytes == 0)
{
break;
}
pBuffers = std::make_unique<char[]>(ulBytes);
RtlZeroMemory(pBuffers.get(), ulBytes);
pMods = (PRTL_PROCESS_MODULES)pBuffers.get();
nStatus = ZwQuerySystemInformation(SystemModuleInformation, pMods, ulBytes, &ulBytes);
if (!NT_SUCCESS(nStatus))
{
break;
}
PRTL_PROCESS_MODULE_INFORMATION pMod = pMods->Modules;
for (ULONG i = 0; i < pMods->NumberOfModules; i++)
{
PCHAR pFileName = strrchr((char*)(pMod[i].FullPathName), '\\');
if (NULL != pFileName)
{
if (0 == _stricmp("\\ntoskrnl.exe", pFileName) ||
0 == _stricmp("\\ntkrnlmp.exe", pFileName) ||
0 == _stricmp("\\ntkrnlpa.exe", pFileName) ||
0 == _stricmp("\\ntkrpamp.exe", pFileName)
)
{
std::cout << pMod[i].FullPathName << "-->0x" << std::hex << pMod[i].ImageBase << std::endl;
break;
}
}
else
{
if (0 == _stricmp("ntoskrnl.exe", (char*)pMod[i].FullPathName) ||
0 == _stricmp("ntkrnlmp.exe", (char*)pMod[i].FullPathName) ||
0 == _stricmp("ntkrnlpa.exe", (char*)pMod[i].FullPathName) ||
0 == _stricmp("ntkrpamp.exe", (char*)pMod[i].FullPathName)
)
{
std::cout << pMod[i].FullPathName << "-->0x" << std::hex << pMod[i].ImageBase << std::endl;
break;
}
}
}
} while (0);
hzqst
