| 1 | #include "memory.h" |
| 2 | |
| 3 | PVOID get_system_module_base(const char* module_name) |
| 4 | { |
| 5 | ULONG bytes = 0; |
| 6 | NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, NULL, bytes, &bytes); |
| 7 | |
| 8 | if (!bytes) |
| 9 | return NULL; |
| 10 | |
| 11 | PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x4e554c4c); |
| 12 | |
| 13 | status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes); |
| 14 | |
| 15 | if (!NT_SUCCESS(status)) |
| 16 | return NULL; |
| 17 | |
| 18 | PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules; |
| 19 | PVOID module_base = 0, module_size = 0; |
| 20 | |
| 21 | for (ULONG i = 0; i < modules->NumberOfModules; i++) |
| 22 | { |
| 23 | if (strcmp((char*)module[i].FullPathName, module_name) == NULL) |
| 24 | { |
| 25 | module_base = module[i].ImageBase; |
| 26 | module_size = (PVOID)module[i].ImageSize; |
| 27 | break; |
| 28 | } |
| 29 | } |
| 30 | |
| 31 | if (modules) |
| 32 | ExFreePoolWithTag(modules, NULL); |
| 33 | |
| 34 | if (module_base <= NULL) |
| 35 | return NULL; |
| 36 | |
| 37 | return module_base; |
| 38 | } |
| 39 | |
| 40 | PVOID get_system_module_export(const char* module_name, LPCSTR routine_name) |
| 41 | { |
no outgoing calls
no test coverage detected