自己做了一个工具需要遍历Windows系统加载的内核模块信息,网上查了一些都是用Zwxxx内核函数来做。后来发现完全没必要...
直接上代码:
#include <windows.h>
#include <psapi.h>
#include <tchar.h>
#include <stdio.h>
#pragma comment(lib, "psapi")
#define ARRAY_SIZE 1024
void EnumKernelModule()
{
LPVOID drivers[ARRAY_SIZE];
DWORD cbNeeded;
int cDrivers, i;
if( EnumDeviceDrivers(drivers, sizeof(drivers), &cbNeeded) &&
cbNeeded < sizeof(drivers))
{
TCHAR szDriver[ARRAY_SIZE];
cDrivers = cbNeeded/sizeof(drivers[0]);
_tprintf(TEXT("There are %d drivers:\n"), cDrivers);
for (i=0; i < cDrivers; i++ )
{
if(GetDeviceDriverBaseName(drivers[i], szDriver,
sizeof(szDriver)/sizeof(szDriver[0])))
{
_tprintf(TEXT("%s\n"), szDriver);
}
}
}
return ;
}
void main()
{
EnumKernelModule();
getchar();
}