| 283 | //} |
| 284 | |
| 285 | NTSTATUS GetModuleBaseAddress(int processId, const char* moduleName, uint64_t* baseAddress) |
| 286 | { |
| 287 | ANSI_STRING ansiString; |
| 288 | UNICODE_STRING compareString; |
| 289 | KAPC_STATE state; |
| 290 | NTSTATUS status = STATUS_UNSUCCESSFUL; |
| 291 | PEPROCESS process = NULL; |
| 292 | PPEB pPeb = NULL; |
| 293 | |
| 294 | RtlInitAnsiString(&ansiString, moduleName); |
| 295 | RtlAnsiStringToUnicodeString(&compareString, &ansiString, TRUE); |
| 296 | |
| 297 | printf("Looking for module %d\n", processId); |
| 298 | |
| 299 | if (!NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)processId, &process))) |
| 300 | return STATUS_UNSUCCESSFUL; |
| 301 | |
| 302 | printf("Found process %d\n", processId); |
| 303 | |
| 304 | KeStackAttachProcess(process, &state); |
| 305 | pPeb = PsGetProcessPeb(process); |
| 306 | |
| 307 | if (pPeb) |
| 308 | { |
| 309 | PPEB_LDR_DATA pLdr = (PPEB_LDR_DATA)pPeb->Ldr; |
| 310 | |
| 311 | if (pLdr) |
| 312 | { |
| 313 | for (PLIST_ENTRY list = (PLIST_ENTRY)pLdr->InMemoryOrderModuleList.Flink; list != &pLdr->InMemoryOrderModuleList; list = (PLIST_ENTRY)list->Flink) |
| 314 | { |
| 315 | PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(list, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); |
| 316 | printf("%wZ\n", pEntry->BaseDllName); |
| 317 | if (RtlCompareUnicodeString(&pEntry->BaseDllName, &compareString, TRUE) == 0) |
| 318 | { |
| 319 | *baseAddress = (uint64_t)pEntry->DllBase; |
| 320 | status = STATUS_SUCCESS; |
| 321 | break; |
| 322 | } |
| 323 | } |
| 324 | } |
| 325 | } |
| 326 | KeUnstackDetachProcess(&state); |
| 327 | RtlFreeUnicodeString(&compareString); |
| 328 | return status; |
| 329 | } |
| 330 | |
| 331 | PVOID GetSystemModuleBase(LPCSTR moduleName) { |
| 332 |
no outgoing calls
no test coverage detected