| 8 | EFI_GUID gEfiGlobalVariableGuid = EFI_GLOBAL_VARIABLE; |
| 9 | |
| 10 | static |
| 11 | NTSTATUS |
| 12 | FindKernelModule( |
| 13 | _In_ PCCH ModuleName, |
| 14 | _Out_ PULONG_PTR ModuleBase |
| 15 | ) |
| 16 | { |
| 17 | *ModuleBase = 0; |
| 18 | |
| 19 | ULONG Size = 0; |
| 20 | NTSTATUS Status; |
| 21 | if ((Status = NtQuerySystemInformation(SystemModuleInformation, nullptr, 0, &Size)) != STATUS_INFO_LENGTH_MISMATCH) |
| 22 | return Status; |
| 23 | |
| 24 | const PRTL_PROCESS_MODULES Modules = static_cast<PRTL_PROCESS_MODULES>(RtlAllocateHeap(RtlProcessHeap(), HEAP_ZERO_MEMORY, 2 * static_cast<SIZE_T>(Size))); |
| 25 | Status = NtQuerySystemInformation(SystemModuleInformation, |
| 26 | Modules, |
| 27 | 2 * Size, |
| 28 | nullptr); |
| 29 | if (!NT_SUCCESS(Status)) |
| 30 | goto Exit; |
| 31 | |
| 32 | for (ULONG i = 0; i < Modules->NumberOfModules; ++i) |
| 33 | { |
| 34 | const PRTL_PROCESS_MODULE_INFORMATION Module = &Modules->Modules[i]; |
| 35 | if (_stricmp(ModuleName, reinterpret_cast<PCHAR>(Module->FullPathName) + Module->OffsetToFileName) == 0) |
| 36 | { |
| 37 | *ModuleBase = reinterpret_cast<ULONG_PTR>(Module->ImageBase); |
| 38 | Status = Module->ImageBase == nullptr ? STATUS_NOT_FOUND : STATUS_SUCCESS; |
| 39 | break; |
| 40 | } |
| 41 | } |
| 42 | |
| 43 | Exit: |
| 44 | RtlFreeHeap(RtlProcessHeap(), 0, Modules); |
| 45 | return Status; |
| 46 | } |
| 47 | |
| 48 | // For Windows Vista/7. Credits: DSEFix by hfiref0x |
| 49 | static |
no outgoing calls