//功能:模块名称,地址
ULONG64 GetDirverBase(char* drivername)
{
NTSTATUS status;
ULONG size;
char* pDrvName;
PSYSTEM_MODULE_INFORMATION moduleinfo;
PSYSTEM_MODULE_INFORMATION_ENTRY moduleinfoentry;
status = NtQuerySystemInformation(11, &size, NULL, &size);
if (status != 0xc0000004)
{
return;
}
moduleinfo = ExAllocatePool(NonPagedPool, size);
if (moduleinfo == NULL)
{
return;
}
do
{
status = NtQuerySystemInformation(11, moduleinfo, size, &size);
if (!NT_SUCCESS(status))
{
break;
}
moduleinfoentry = moduleinfo->Module;
for (ULONG i = 0; i < moduleinfo->Count; i++)
{
pDrvName = moduleinfoentry->ImageName + moduleinfoentry->ModuleNameOffset;
if (!_stricmp(drivername, pDrvName))
{
ExFreePool(moduleinfo);
return (ULONG64)moduleinfoentry->Base;
}
moduleinfoentry++;
}
} while (FALSE);
ExFreePool(moduleinfo);
return 0;
}
驱动编程,通过驱动名获取驱动模块地址
最新推荐文章于 2023-06-28 09:21:02 发布