使用NtQuerySystemInformation来检索加载的模块，从加载模块里面搜索出ntoskrnl.exe模块
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
NTSTATUS Status; PUCHAR BaseAddress = NULL; NTSTATUS ntStatus; PMODULES pModules; ULONG NeededSize; pModules = (PMODULES)&pModules; ntStatus = NtQuerySystemInformation(SystemModuleInformation, pModules, 4, &NeededSize); if(ntStatus == STATUS_INFO_LENGTH_MISMATCH) { pModules = (PMODULES)ExAllocatePool(PagedPool, NeededSize); if(!pModules) return STATUS_INSUFFICIENT_RESOURCES; ntStatus = NtQuerySystemInformation(SystemModuleInformation, pModules, NeededSize, NULL); if(!NT_SUCCESS(ntStatus)) { ExFreePool(pModules); return ntStatus; } } if(!NT_SUCCESS(ntStatus)) { return ntStatus; } BaseAddress = (PUCHAR)pModules->smi.Module[0].MappedBase; |
转载请注明：exchen's blog » 获取ntoskrnl的基址