【原创】X64 枚举 内核 符号~~~~

typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)
(
IN ULONG SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG Length,
OUT PULONG ReturnLength
);


typedef unsigned long DWORD;


typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY
{
    ULONG Unknow1;
    ULONG Unknow2;
    ULONG Unknow3;
ULONG Unknow4;
    PVOID Base;
    ULONG Size;
    ULONG Flags;
    USHORT Index;
    USHORT NameLength;
    USHORT LoadCount;
    USHORT ModuleNameOffset;
    char ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;


typedef struct _SYSTEM_MODULE_INFORMATION
{
    ULONG Count;//内核中以加载的模块的个数
    SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
X64 枚举 内核 模块 需要的 结构体 






ULONG64 EnumKM(char *HighlightDrvName) 枚举 内核模块 返回 基地址 
{
    ULONG NeedSize, i, ModuleCount, HLed=0, BufferSize = 0x5000;
    PVOID pBuffer = NULL;
PCHAR pDrvName = NULL;
    NTSTATUS Result;
ULONG64 address;
    PSYSTEM_MODULE_INFORMATION pSystemModuleInformation;
    do
    {
        //分配内存
        pBuffer = malloc( BufferSize );
        if( pBuffer == NULL )
            return 0;
        //查询模块信息
        Result = ZwQuerySystemInformation( 11, pBuffer, BufferSize, &NeedSize );
        if( Result == 0xC0000004L )
        {
            free( pBuffer );
            BufferSize *= 2;
        }
        else if( Result<0 )
        {
            //查询失败则退出
            free( pBuffer );
            return 0;
        }
    }
    while( Result == 0xC0000004L );
    pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)pBuffer;
//获得模块的总数量
    ModuleCount = pSystemModuleInformation->Count;
//遍历所有的模块
    for( i = 0; i < ModuleCount; i++ )
{
if((ULONG64)(pSystemModuleInformation->Module[i].Base) > (ULONG64)0x8000000000000000)
{
pDrvName = pSystemModuleInformation->Module[i].ImageName+pSystemModuleInformation->Module[i].ModuleNameOffset;

if( _stricmp(pDrvName,HighlightDrvName)==0 )
{
address = (ULONG64)pSystemModuleInformation->Module[i].Base;

HLed=1;
break;
}

}
}
if (HLed == 0)
return 0;
free(pBuffer);
return address;
}
BOOL CALLBACK EnumSymCallBack(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext)回调 函数 
{
if (strcmp((pSymInfo->Name), "PspCreateProcessNotifyRoutine") == 0)
{
printf("Oh,yeah! %s :%p\n", pSymInfo->Name, pSymInfo->Address);
}
if (strcmp((pSymInfo->Name), "PspLoadImageNotifyRoutine") == 0)
{
printf("Oh,yeah! %s :%p\n", pSymInfo->Name, pSymInfo->Address);
}
if (strcmp((pSymInfo->Name), "PspCreateThreadNotifyRoutine") == 0)
{
printf("Oh,yeah! %s :%p\n", pSymInfo->Name, pSymInfo->Address);
}
if (strcmp((pSymInfo->Name), "PspCidTable") == 0)
{
printf("Oh,yeah! %s :%p\n", pSymInfo->Name, pSymInfo->Address);
}
if (strcmp((pSymInfo->Name), "ExDestroyHandle") == 0)
{
printf("Oh,yeah! %s :%p\n", pSymInfo->Name, pSymInfo->Address);
}


return TRUE;
}


void getallkrnladdress(ULONG64 ntkrnlmpBaseaddress){ 加载 符号链接 并枚举 




HANDLE hProcess;
DWORD64 BaseOfDll;
PIMAGEHLP_SYMBOL pSymbol = NULL;


DWORD Options = SymGetOptions();


Options = Options | SYMOPT_DEBUG;
SymSetOptions(Options);


hProcess = GetCurrentProcess();
BOOL bRet = SymInitialize(hProcess, 0, FALSE);
if (!bRet)
{
printf("SymInitialize error ...\n");
}
char SymbolPath[256];
GetCurrentDirectoryA(sizeof(SymbolPath), SymbolPath);
strcat(SymbolPath, "\\symbols");
SymSetSearchPath(hProcess, SymbolPath);


char FileName[256];
GetSystemDirectoryA(FileName, sizeof(FileName));
strcat(FileName, "\\ntkrnlmp.exe");
HANDLE hFile = CreateFileA(FileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
DWORD dwfilesize = GetFileSize(hFile, NULL);


BaseOfDll = SymLoadModule64(hProcess, NULL, FileName, NULL, ntkrnlmpBaseaddress, dwfilesize);
if (BaseOfDll == 0)
{
DWORD nErr = GetLastError();
}
SymEnumSymbols(hProcess, BaseOfDll, 0, EnumSymCallBack, 0);
SymUnloadModule64(hProcess, BaseOfDll);
SymCleanup(hProcess);
for (;;);


}
int main()   用法 
{
ULONG64 ntkrnlmpBaseaddress;
ZwQuerySystemInformation=(ZWQUERYSYSTEMINFORMATION)GetProcAddress(LoadLibraryW(L"ntdll.dll"),"ZwQuerySystemInformation");
ntkrnlmpBaseaddress=EnumKM("ntkrnlmp.exe");//获得 NT内核模块基地址 

getallkrnladdress(ntkrnlmpBaseaddress);



getchar();
return 0;
}
完整  SRC :http://pan.baidu.com/s/1sjuZg2D
网上代码 抄抄改改 就好了  ，听说老大 都不用硬编码了   所以  ~~~~