linux下获取模块基址,驱动学习十三（获取内核模块名和基址）

#include "ntddk.h"

#include

typedef enum _SYSTEM_INFORMATION_CLASS

{

SystemModuleInformation = 11,

} SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_MODULE_INFORMATION

{

ULONG Reserved[2];

PBYTE Base;

ULONG Size;

ULONG Flags;

USHORT Index;

USHORT Unknown;

USHORT LoadCount;

USHORT ModuleNameOffset;

CHAR ImageName[256];

} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _SYSTEM_MODULE_INFO_LIST

{

ULONG ulCount;

SYSTEM_MODULE_INFORMATION smi[1];

} SYSTEM_MODULE_INFO_LIST, *PSYSTEM_MODULE_INFO_LIST;

extern"C"NTSTATUS __stdcall ZwQuerySystemInformation(

SYSTEM_INFORMATION_CLASS SystemInformationClass,

PVOID SystemInformation,

ULONG SystemInformationLength,

PULONG ReturnLength

);

// 获取kernel模块的信息

NTSTATUS GetKernelModuleInfo(PSYSTEM_MODULE_INFORMATION pSysModInfo)

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

PSYSTEM_MODULE_INFO_LIST pSysModInfoList = NULL;

ULONG ulLength = 0;

status = ZwQuerySystemInformation(SystemModuleInformation, pSysModInfoList, ulLength, &ulLength);

if(status != STATUS_INFO_LENGTH_MISMATCH)

{

return STATUS_UNSUCCESSFUL;

}

pSysModInfoList = (PSYSTEM_MODULE_INFO_LIST)ExAllocatePool(NonPagedPool, ulLength);

if(NULL == pSysModInfoList)

{

return STATUS_UNSUCCESSFUL;

}

status = ZwQuerySystemInformation(SystemModuleInformation, pSysModInfoList, ulLength, &ulLength);

if(!NT_SUCCESS(status))

{

ExFreePool(pSysModInfoList);

return STATUS_UNSUCCESSFUL;

}

memcpy(pSysModInfo->ImageName,pSysModInfoList->smi[0].ImageName,sizeof(char)*256);

pSysModInfo->Base=pSysModInfoList->smi[0].Base;

ExFreePool(pSysModInfoList);

return STATUS_SUCCESS;

}

void DriverUnload(PDRIVER_OBJECT pDeviceObject)

{

}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pUnicodeString)

{

PSYSTEM_MODULE_INFORMATION info={0};

pDriverObject->DriverUnload=DriverUnload; //设置卸载例程

info = (PSYSTEM_MODULE_INFORMATION)ExAllocatePool(NonPagedPool, sizeof(SYSTEM_MODULE_INFORMATION));

GetKernelModuleInfo(info);

DbgPrint("内核文件名:%s 基址:%08x\n",info->ImageName,info->Base);

ExFreePool(info);

return STATUS_SUCCESS;

}