驱动层虚拟机检测参考爱写驱动的女装大佬

#include <ntddk.h>
#include <windef.h>

typedef	struct _SYSTEM_MODULE_INFORMATION{
	HANDLE Section;
	PVOID  MappedBase;
	PVOID  base;
	ULONG  Size;
	ULONG  Flags;
	USHORT LoadOrderIndex;
	USHORT InitOrderIndex;
	USHORT LoadCount;
	USHORT PathLength;
	CHAR	ImageName[256];

}SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef	NTSTATUS(*NTQUERYSYSTEMINFORMATION)(
	ULONG SystemInformationClass,
	PVOID SystemInformation,
	ULONG_PTR SystemInformationLength,
	PULONG_PTR ReturnLength OPTIONAL
	);
BOOLEAN	bStoped = FALSE;
PVOID	pThreadObj=NULL;
NTSTATUS Unload(PDRIVER_OBJECT driver)
{
	DbgPrint("unloaded!");
	bStoped = TRUE;
	KeWaitForSingleObject(pThreadObj, Executive, KernelMode, FALSE, NULL);
	ObDereferenceObject(pThreadObj);
	return STATUS_SUCCESS;
}

BOOLEAN  CheckVm()
{
	BOOLEAN bRet = FALSE;
	NTQUERYSYSTEMINFORMATION n_NtQuerySystemInformation = NULL;
	UNICODE_STRING NtQuerySystemInformation_Name = { 0 };
	PSYSTEM_MODULE