使用ZwQueryVirtualMemory枚举进程模块支持x64

最新代码(内核) 应用层简单改下即可

typedef struct _MEMORY_SECTION_NAME {
        UNICODE_STRING Name;
        WCHAR     Buffer[260];
    }MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
    
		ULONG_PTR dqCurrentBase = 0;
        PEPROCESS Process = nullptr;

        MEMORY_BASIC_INFORMATION baseinfo;
        MEMORY_SECTION_NAME sec;

        do
        {
            auto status = PsLookupProcessByProcessId(pid, &Process);

            if (!NT_SUCCESS(status))
                break;

            RtlZeroMemory(&baseinfo, sizeof(baseinfo));

            SIZE_T ret = 0;

            KeAttachProcess(Process);

            for (dqCurrentBase = 0; 
                NT_SUCCESS(ZwQueryVirtualMemory(NtCurrentProcess(), (PVOID)dqCurrentBase, MemoryBasicInformation, &baseinfo, sizeof(MEMORY_BASIC_INFORMATION), &ret));
                dqCurrentBase = (ULONG_PTR)baseinfo.BaseAddress + baseinfo.RegionSize)
            {
                if (baseinfo.Type == MEM_IMAGE && (ULONG_PTR)baseinfo.AllocationBase == dqCurrentBase)
                {
                    // MemorySectionName
                    if (NT_SUCCESS(ZwQueryVirtualMemory(NtCurrentProcess(), (PVOID)dqCurrentBase, (MEMORY_INFORMATION_CLASS)2, &sec, sizeof(MEMORY_SECTION_NAME), &ret)))
                    {
                        base = (PVOID)dqCurrentBase;

                        DPRINT("0x%llx, %wZ