Function GetSystemModuleBase

Driver/core.cpp:331–374

    }

    PVOID GetSystemModuleBase(LPCSTR moduleName) {

        PVOID moduleBase = NULL;
        ULONG info = 0;

        NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, 0, info, &info);

        if (!info) {
            return moduleBase;
        }

        PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, info, 0x89109929301);

        status = ZwQuerySystemInformation(SystemModuleInformation, modules, info, &info);

        if (!NT_SUCCESS(status)) {
            return moduleBase;
        }

        PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules;


        if (modules->NumberOfModules > 0) {

            if (!moduleName) {
                moduleBase = modules->Modules[0].ImageBase;
            }
            else {

                for (auto i = 0; i < modules->NumberOfModules; i++) {
                    printf("module[i].FullPathName: %s", module[i].FullPathName);
                    if (!strcmp((CHAR*)module[i].FullPathName, moduleName)) {
                        moduleBase = module[i].ImageBase;
                    }
                }
            }
        }

        if (modules) {
            ExFreePoolWithTag(modules, 0x89109929301);
        }

        return moduleBase;
    }

}