获取内核地址大小路径

#include"ntifs.h"
#include"intsafe.h"
#include"ntimage.h"
#define out
#define in
#define SystemModuleInformation 11
ULONG_PTR jizhi_neihe = 0;
ULONG_PTR daxiao_neihe = 0;
WCHAR *pwz_kernel_path = NULL;
NTSTATUS __stdcall ZwQuerySystemInformation(ULONG_PTR SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
typedef NTSTATUS
(*NTCREATEFILE) (
__out PHANDLE FileHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__out PIO_STATUS_BLOCK IoStatusBlock,
__in_opt PLARGE_INTEGER AllocationSize,
__in ULONG FileAttributes,
__in ULONG ShareAccess,
__in ULONG CreateDisposition,
__in ULONG CreateOptions,
__in_bcount_opt(EaLength) PVOID EaBuffer,
__in ULONG EaLength
);
typedef struct _SYSTEM_MODULE_INFORMATION  // 系统模块信息
{
	ULONG  Reserved[2];
	ULONG  Base;
	ULONG  Size;
	ULONG  Flags;
	USHORT Index;
	USHORT Unknown;
	USHORT LoadCount;
	USHORT ModuleNameOffset;
	CHAR   ImageName[256];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _tagSysModuleList //模块链结构
{
	ULONG ulCount;
	SYSTEM_MODULE_INFORMATION smi[1];
} MODULES, *PMODULES;
typedef NTSTATUS(__stdcall *NTOPENPROCESS)(
	PHANDLE ProcessHandle,
	ACCESS_MASK DesiredAccess,
	POBJECT_ATTRIBUTES ObjectAttributes,
	PCLIENT_ID ClientId
	);
NTOPENPROCESS ReloadNtOpenProcess;
BOOLEAN GetSystemKernelModuleInfo(WCHAR **SystemKernelModulePath, PULONG_PTR SystemKernelModuleBase, PULONG_PTR SystemKernelModuleSize)
{

	NTSTATUS status;
	ULONG ulSize;
	int i;
	PMODULES pModuleList;
	char *lpszKernelName = NULL;
	ANSI_STRING AnsiKernelModule;
	UNICODE_STRING UnicodeKernelModule;
	BOOLEAN bRet = TRUE;

	__try
	{
		status = ZwQuerySystemInformation(
			SystemModuleInformation,
			NULL,
			0,
			&ulSize
			);
		if (status != STATUS_INFO_LENGTH_MISMATCH)
		{
			return 0;
		}
		pModuleList = (PMODULES)ExAllocatePool(NonPagedPool, ulSize);
		if (pModuleList)
		{
			status = ZwQuerySystemInformation(
				SystemModuleInformation,
				pModuleList,
				ulSize,
				&ulSize
				);
			if (!NT_SUCCESS(status))
			{
				KdPrint(("ZwQuerySystemInformation error:%x %d\r\n", status, RtlNtStatusToDosError(status)));
				bRet = FALSE;
			}
		}
		if (!bRet)
		{
			if (pModuleList)
				ExFreePool(pModuleList);
			return 0;
		}
		*SystemKernelModulePath = ExAllocatePool(NonPagedPool, 260 * 2);
		if (*SystemKernelModulePath == NULL)
		{
			*SystemKernelModuleBase = 0;
			*SystemKernelModuleSize = 0;
			return 0;
		}

		lpszKernelName = pModuleList->smi[0].ModuleNameOffset + pModuleList->smi[0].ImageName;
		RtlInitAnsiString(&AnsiKernelModule, lpszKernelName);
		RtlAnsiStringToUnicodeString(&UnicodeKernelModule, &AnsiKernelModule, TRUE);

		RtlZeroMemory(*SystemKernelModulePath, 260 * 2);
		wcscat(*SystemKernelModulePath, L"\\SystemRoot\\system32\\");

		memcpy(
			*SystemKernelModulePath + wcslen(L"\\SystemRoot\\system32\\"),
			UnicodeKernelModule.Buffer,
			UnicodeKernelModule.Length
			);

		*SystemKernelModuleBase = (ULONG_PTR)pModuleList->smi[0].Base;
		*SystemKernelModuleSize = (ULONG_PTR)pModuleList->smi[0].Size;
		ExFreePool(pModuleList);
		RtlFreeUnicodeString(&UnicodeKernelModule);

	}
	__except (EXCEPTION_EXECUTE_HANDLER){

	}
	return TRUE;
}
KdPrint(("驱动开始\n"));
	GetSystemKernelModuleInfo(&pwz_kernel_path, &jizhi_neihe, &daxiao_neihe);
	KdPrint(("路径%S 基址%x 大小%x  %d \n", pwz_kernel_path, jizhi_neihe, daxiao_neihe, daxiao_neihe));