()
| 33 | |
| 34 | |
| 35 | def enumerate_kernel_modules(): |
| 36 | if windows.current_process.is_wow_64: |
| 37 | return enumerate_kernel_modules_syswow64() |
| 38 | cbsize = gdef.DWORD() |
| 39 | winproxy.NtQuerySystemInformation(gdef.SystemModuleInformation, None, 0, ctypes.byref(cbsize)) |
| 40 | raw_buffer = (cbsize.value * gdef.BYTE)() |
| 41 | buffer = gdef.SYSTEM_MODULE_INFORMATION.from_address(ctypes.addressof(raw_buffer)) |
| 42 | winproxy.NtQuerySystemInformation(gdef.SystemModuleInformation, ctypes.byref(raw_buffer), ctypes.sizeof(raw_buffer), ctypes.byref(cbsize)) |
| 43 | modules = (SystemModule * buffer.ModulesCount).from_buffer(raw_buffer, gdef.SYSTEM_MODULE_INFORMATION.Modules.offset) |
| 44 | return list(modules) |
| 45 | |
| 46 | def enumerate_kernel_modules_syswow64(): |
| 47 | cbsize = gdef.DWORD() |
nothing calls this directly
no test coverage detected