#include "kernel_function.h"
#include "kernel_api.h"

namespace kernel_function
{
	PEPROCESS process{ 0 };

	auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
	{
		for (ULONG i = 4; i < 0x401000; i += 4)
		{
			auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
			if (!NT_SUCCESS(status))
				continue;

			auto image_file_name = reinterpret_cast<char*>(kernel_api::psgetprocessimagefilname(process));
			if (!strcmp(image_file_name, ProcessName))
				return process;

			ObDereferenceObject(process);
		}

		return process;
	}
	auto GetKernelModule(CONST CHAR* Module) -> uintptr_t
	{
		UNICODE_STRING unFuncName{ 0 };

		void* buffer = nullptr;
		DWORD buffer_size = 0;


	retry:
		buffer = ExAllocatePool(NonPagedPool, buffer_size);
		NTSTATUS status = kernel_api::ntquerysysteminformation(static_cast <SYSTEM_INFORMATION_CLASS>(11), buffer, buffer_size, &buffer_size);
		if (status == STATUS_INFO_LENGTH_MISMATCH)
		{
			if (buffer)
				ExFreePool(buffer);

			goto retry;
		}


		uintptr_t base = 0;
		const auto modulebase = static_cast<PRTL_PROCESS_MODULES>(buffer);

		if (!modulebase)
			return 0;

		for (auto i = 0u; i < modulebase->NumberOfModules; i++)
		{
			const char* current_module_name = (reinterpret_cast<char*>(modulebase->Modules[i].FullPathName) + modulebase->Modules[i].OffsetToFileName);

			if (!_stricmp(current_module_name, Module))
			{
				const auto ImageBase = modulebase->Modules[i].ImageBase;
				base = (uintptr_t)ImageBase;
				break;
			}
		}


		ExFreePool(buffer);

		return base;
	}


}