SystemInformationClassindicates what information the function should query. Here we pass
SystemModuleInformationas argument to get information about all kernel modules.
SystemInformationbuffer to get accurate size of this information, allocate memory respectively and query system information.
_SYSTEM_MODULE_INFORMATIONis a list of
_SYSTEM_MODULE_ENTRYin which each element represents a information block of corresponding module.
pMods->Module.ImageBase. For other modules we can loop through the list and compare each entry's FullPathName, with our target module's path to get target module's base address.
AuxKlibQueryModuleInformationwhich belongs to the lib
Aux_Klib( Note you have to add it to link manually) to query ONLY system module information. This function is declared as below ( see msdn pages for details ):
AuxKlibInitializefirst (which is needed in any function call in Aux_Klib )
ZwQuerySystemInformation, we need to get specific size of the information buffer.
AUX_MODULE_EXTENDED_INFOstructures, declared as:
LIST_ENTRYdata structure in kernel named
PsLoadedModuleList, which is the head of a list of information blocks about all kernel modules. Each block has a structure defined as below:
InLoadOrderLinksof every block is linked to the list, so we can traverse the list and for a block retrieve some information like
BaseDllName, then compare them with our target module and get its base address.
DriverEntry, there is a parameter named
DriverObjectwhich has type of
PDRIVER_OBJECT( see msdn pages for detailed information of this structure ). The field
PVOIDtype is actually a pointer to the
KLDR_LOAD_TABLE_ENTRYstructure stored information of the driver module, which is exactly the block inserted into the system modules list.
\Driver\driver-name, and we can get it's driver object pointer with its name by an undocumented function
ObReferenceObjectByName, declared below:
ObjectPathis the driver name we need to specify,
AccessModeneeds to be
ObjectPtris used to receive the pointer to
_DRIVER_OBJECTstructure of specified driver module. Moreover the parameter
ObjectTypeindicates which type the object belongs to, here the driver is
IoDriverObjectType( Note this type is undocumented so we need declare it explicitly as below).
KLDR_LOAD_TABLE_ENTRYstructure through the
DriverSectionfield and get some useful information including its base address.