应用层枚举内核模块

最新推荐文章于 2023-08-15 00:42:53 发布

maomao171314

最新推荐文章于 2023-08-15 00:42:53 发布

阅读量442

点赞数

分类专栏：杂项文章标签：枚举内核模块

本文链接：https://blog.youkuaiyun.com/maomao171314/article/details/125895755

版权

杂项专栏收录该内容

22 篇文章

订阅专栏

本文档展示了如何使用`NTSTATUSEnumKernelModules`和`NTSTATUSEnumKernelModulesEx`函数获取系统模块信息，包括模块的基地址、大小、加载顺序等。通过示例代码，演示了如何遍历并打印出内核模块的全路径名。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

应用层枚举内核模块

typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
    HANDLE Section;
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    UCHAR FullPathName[256];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;

typedef struct _RTL_PROCESS_MODULES
{
    ULONG NumberOfModules;
    RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

// private
typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
{
    USHORT NextOffset;
    RTL_PROCESS_MODULE_INFORMATION BaseInfo;
    ULONG ImageChecksum;
    ULONG TimeDateStamp;
    PVOID DefaultBase;
} RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX;


NTSTATUS EnumKernelModules(
    _Out_ PRTL_PROCESS_MODULES* Modules
)
{
    NTSTATUS status;
    PVOID buffer;
    ULONG bufferSize = 2048;

    buffer = malloc(bufferSize);

    status = NtQuerySystemInformation(
        SystemModuleInformation,
        buffer,
        bufferSize,
        &bufferSize
    );

    if (status == STATUS_INFO_LENGTH_MISMATCH)
    {
        //PhFree(buffer);
        free(buffer);
        buffer = NULL;
        buffer = malloc(bufferSize);

        status = NtQuerySystemInformation(
            SystemModuleInformation,
            buffer,
            bufferSize,
            &bufferSize
        );
    }

    if (!NT_SUCCESS(status))
        return status;

    *Modules = (PRTL_PROCESS_MODULES)buffer;

    return status;
}

NTSTATUS EnumKernelModulesEx(
    _Out_ PRTL_PROCESS_MODULE_INFORMATION_EX* Modules
)
{
    NTSTATUS status;
    PVOID buffer;
    ULONG bufferSize = 2048;

    buffer = malloc(bufferSize);

    status = NtQuerySystemInformation(
        SystemModuleInformationEx,
        buffer,
        bufferSize,
        &bufferSize
    );

    if (status == STATUS_INFO_LENGTH_MISMATCH)
    {
        free(buffer);
        buffer = malloc(bufferSize);

        status = NtQuerySystemInformation(
            SystemModuleInformationEx,
            buffer,
            bufferSize,
            &bufferSize
        );
    }

    if (!NT_SUCCESS(status))
        return status;

    *Modules = (PRTL_PROCESS_MODULE_INFORMATION_EX)buffer;

    return status;
}

int main()
{    
    PRTL_PROCESS_MODULES kernelModules;
    PhEnumKernelModules(&kernelModules);
    for (size_t i = 0; i < kernelModules->NumberOfModules; i++)
    {
        printf("name : %s \n", kernelModules->Modules[i].FullPathName);
    }

    printf("name : %s \n", "------------------------------------------");
    PRTL_PROCESS_MODULE_INFORMATION_EX kernelModulesEx;
    PhEnumKernelModulesEx(&kernelModulesEx);
    PRTL_PROCESS_MODULE_INFORMATION_EX pKernel = kernelModulesEx;
    do
    {
        printf("name : %s \n",pKernel->BaseInfo.FullPathName);
        pKernel = (PRTL_PROCESS_MODULE_INFORMATION_EX)((ULONG)pKernel + pKernel->NextOffset);
    } while (pKernel != NULL && pKernel->NextOffset != 0);
}