| 108 | } |
| 109 | |
| 110 | ULONG64 get_module_base_x64(PEPROCESS proc, UNICODE_STRING module_name) |
| 111 | { |
| 112 | PPEB pPeb = PsGetProcessPeb(proc); |
| 113 | |
| 114 | if (!pPeb) |
| 115 | { |
| 116 | return NULL; |
| 117 | } |
| 118 | |
| 119 | KAPC_STATE state; |
| 120 | |
| 121 | KeStackAttachProcess(proc, &state); |
| 122 | |
| 123 | PPEB_LDR_DATA pLdr = (PPEB_LDR_DATA)pPeb->Ldr; |
| 124 | |
| 125 | if (!pLdr) |
| 126 | { |
| 127 | KeUnstackDetachProcess(&state); |
| 128 | return NULL; |
| 129 | } |
| 130 | |
| 131 | for (PLIST_ENTRY list = (PLIST_ENTRY)pLdr->ModuleListLoadOrder.Flink; list != &pLdr->ModuleListLoadOrder; list = (PLIST_ENTRY)list->Flink) |
| 132 | { |
| 133 | PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(list, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList); |
| 134 | |
| 135 | if (RtlCompareUnicodeString(&pEntry->BaseDllName, &module_name, TRUE) == NULL) |
| 136 | { |
| 137 | ULONG64 baseAddr = (ULONG64)pEntry->DllBase; |
| 138 | KeUnstackDetachProcess(&state); |
| 139 | return baseAddr; |
| 140 | } |
| 141 | } |
| 142 | |
| 143 | KeUnstackDetachProcess(&state); |
| 144 | return NULL; |
| 145 | } |
| 146 | |
| 147 | bool read_kernel_memory(HANDLE pid, uintptr_t address, void* buffer, SIZE_T size) |
| 148 | { |