| 40 | } |
| 41 | |
| 42 | PVOID get_system_module_base(const char* module_name) |
| 43 | { |
| 44 | ULONG bytes = 0; |
| 45 | NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, NULL, bytes, &bytes); |
| 46 | |
| 47 | if (!bytes) |
| 48 | return NULL; |
| 49 | |
| 50 | PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x4e554c4c); |
| 51 | |
| 52 | status = ZwQuerySystemInformation(SystemModuleInformation, modules, bytes, &bytes); |
| 53 | |
| 54 | if (!NT_SUCCESS(status)) |
| 55 | return NULL; |
| 56 | |
| 57 | PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules; |
| 58 | PVOID module_base = 0, module_size = 0; |
| 59 | |
| 60 | for (ULONG i = 0; i < modules->NumberOfModules; i++) { |
| 61 | if (strcmp((char*)module[i].FullPathName, module_name) == NULL) { |
| 62 | module_base = module[i].ImageBase; |
| 63 | module_size = (PVOID)module[i].ImageSize; |
| 64 | break; |
| 65 | } |
| 66 | } |
| 67 | |
| 68 | if (0 == 0) { |
| 69 | PEPROCESS process1; |
| 70 | } |
| 71 | |
| 72 | if (modules) |
| 73 | ExFreePoolWithTag(modules, NULL); |
| 74 | |
| 75 | if (module_base <= NULL) |
| 76 | return NULL; |
| 77 | |
| 78 | return module_base; |
| 79 | } |
| 80 | |
| 81 | PVOID get_system_module_export(const char* module_name, LPCSTR routine_name) |
| 82 | { |
no outgoing calls
no test coverage detected