71 lines
1.5 KiB
C++
71 lines
1.5 KiB
C++
#include "kernel_function.h"
|
|
#include "kernel_api.h"
|
|
|
|
namespace kernel_function
|
|
{
|
|
PEPROCESS process{ 0 };
|
|
|
|
auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
|
|
{
|
|
for (ULONG i = 4; i < 0x401000; i += 4)
|
|
{
|
|
auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
|
|
if (!NT_SUCCESS(status))
|
|
continue;
|
|
|
|
auto image_file_name = reinterpret_cast<char*>(kernel_api::psgetprocessimagefilname(process));
|
|
if (!strcmp(image_file_name, ProcessName))
|
|
return process;
|
|
|
|
ObDereferenceObject(process);
|
|
}
|
|
|
|
return process;
|
|
}
|
|
auto GetKernelModule(CONST CHAR* Module) -> uintptr_t
|
|
{
|
|
UNICODE_STRING unFuncName{ 0 };
|
|
|
|
void* buffer = nullptr;
|
|
DWORD buffer_size = 0;
|
|
|
|
|
|
retry:
|
|
buffer = ExAllocatePool(NonPagedPool, buffer_size);
|
|
NTSTATUS status = kernel_api::ntquerysysteminformation(static_cast <SYSTEM_INFORMATION_CLASS>(11), buffer, buffer_size, &buffer_size);
|
|
if (status == STATUS_INFO_LENGTH_MISMATCH)
|
|
{
|
|
if (buffer)
|
|
ExFreePool(buffer);
|
|
|
|
goto retry;
|
|
}
|
|
|
|
|
|
uintptr_t base = 0;
|
|
const auto modulebase = static_cast<PRTL_PROCESS_MODULES>(buffer);
|
|
|
|
if (!modulebase)
|
|
return 0;
|
|
|
|
for (auto i = 0u; i < modulebase->NumberOfModules; i++)
|
|
{
|
|
const char* current_module_name = (reinterpret_cast<char*>(modulebase->Modules[i].FullPathName) + modulebase->Modules[i].OffsetToFileName);
|
|
|
|
if (!_stricmp(current_module_name, Module))
|
|
{
|
|
const auto ImageBase = modulebase->Modules[i].ImageBase;
|
|
base = (uintptr_t)ImageBase;
|
|
break;
|
|
}
|
|
}
|
|
|
|
|
|
ExFreePool(buffer);
|
|
|
|
return base;
|
|
}
|
|
|
|
|
|
}
|