Skip to content

Instantly share code, notes, and snippets.

@Little-Ki
Created October 23, 2020 14:51
Show Gist options
  • Save Little-Ki/55e0c9293ca074299018326f96bacdde to your computer and use it in GitHub Desktop.
Save Little-Ki/55e0c9293ca074299018326f96bacdde to your computer and use it in GitHub Desktop.
[Code] [Kernel] Enum module which in current process
/* Enum module which in current process */
struct Module_t {
ULONG64 base;
ULONG64 size;
std::string name;
}
void EnumModule( std::vector<Module_t> & list )
{
std::vector<char> tmpBuf;
ULONG needSize;
ZwQuerySystemInformation( 11, NULL, 0, &needSize );
tmpBuf.resize( needSize );
ZwQuerySystemInformation( 11, tmpBuf.data(), needSize, &needSize );
PSYSTEM_MODULE_INFORMATION pModules;
pModules = (PSYSTEM_MODULE_INFORMATION) tmpBuf.data();
for ( int i = 0; i < pModules->Count; i++ )
{
PCHAR pName =
pModules->Module[i].ImageName
+ pModules->Module[i].ModuleNameOffset;
list.push_back( {
(ULONG64) pModules->Module[i].Base;
pModules->Module[i].Size;
pName
} );
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment