How list all modules of system (not modules of my own process)?

Question

I want list all modules of system. Have a code that list only all modules loaded in my own process. So, how change the following code for turn able of enumerate all modules of system (including ntoskrnl.exe and win32k.sys)? thank you.

====================

#include <stdio.h>
#include <conio.h>
#include <Windows.h>
#include <winternl.h>

#pragma comment(lib,"ntdll.lib")

typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
    HANDLE Section;
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    UCHAR FullPathName[256];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;

typedef struct _RTL_PROCESS_MODULES
{
    ULONG NumberOfModules;
    RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

int main()
{
    NTSTATUS status;
    ULONG i;

    PRTL_PROCESS_MODULES ModuleInfo;

    ModuleInfo=(PRTL_PROCESS_MODULES)VirtualAlloc(NULL,1024*1024,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); // Allocate memory for the module list

    if(!ModuleInfo)
    {
        printf("\nUnable to allocate memory for module list (%d)\n",GetLastError());
        return -1;
    }

    if(!NT_SUCCESS(status=NtQuerySystemInformation((SYSTEM_INFORMATION_CLASS)11,ModuleInfo,1024*1024,NULL))) // 11 = SystemModuleInformation
    {
        printf("\nError: Unable to query module list (%#x)\n",status);

        VirtualFree(ModuleInfo,0,MEM_RELEASE);
        return -1;
    }

    for(i=0;i<ModuleInfo->NumberOfModules;i++)
    {
        printf("\n*****************************************************\n");
        printf("\nImage base: %#x\n",ModuleInfo->Modules[i].ImageBase);
        printf("\nImage name: %s\n",ModuleInfo->Modules[i].FullPathName+ModuleInfo->Modules[i].OffsetToFileName);
        printf("\nImage full path: %s\n",ModuleInfo->Modules[i].FullPathName);
        printf("\nImage size: %d\n",ModuleInfo->Modules[i].ImageSize);
        printf("\n*****************************************************\n");
    }

    VirtualFree(ModuleInfo,0,MEM_RELEASE);

    getch();
    return 0;
}

Produce a succinct specification for what *"all modules of [the] system"* means, and convert it to code. We don't know what that is supposed to mean. — IInspectable, Oct 27 '17 at 15:59
`"\nImage base: %#x\n"` - `%#x` is your error. use `%p` format here — RbMm, Oct 27 '17 at 16:01
@RbMm, relative to my last comment on previous post, my code usermode (that finds correctly iimage base address) that returns image base of *win32k.sys* is in Delphi (Pascal). Then i wants make the same thing here in C++ (usermode) to compare image base values (C++: usermode and kernel mode) respectivally) to try find why kernel code returns wrong address of *win32k.sys* on Win 8.1 and highter). — , Oct 27 '17 at 16:35
@JoãoPablo - only by some mistake in your code. my code perfect work from xp to win10 — RbMm, Oct 27 '17 at 16:40
@RbMm, sincerelly i don't know where is error, once that works fine until Win 8. You saw on screenshot in my [last comment](https://stackoverflow.com/questions/46961637/kernel-mode-bsod-to-obtain-image-base-of-win32k-sys-module?noredirect=1#comment80879516_46961637) of my previous question that base address is ok! but image base address already is different of **0x00010000** :-( — , Oct 27 '17 at 17:23
You could point on code of my previous question (if possible indentify) where i'm making wrong please? — , Oct 27 '17 at 17:28
@RbMm, yes. But still i'm getting the list of module only of my own process. — , Oct 27 '17 at 17:34
@JoãoPablo - *only of my own process* - what you mean ? this code must list kernel drivers. — RbMm, Oct 27 '17 at 17:37
@RbMm, i also think this. This is a usermode code. List only dlls files (and only of my own process). — , Oct 27 '17 at 17:43
@JoãoPablo - user mode - and so what ?? why when i write this code all perfect worked ? — RbMm, Oct 27 '17 at 17:44
@RbMm, to say true, this code above not list modules of my own process but list **only some dll files** of system. Not list *.sys, *.exe files. If you test you will see. — , Oct 27 '17 at 17:53
this can not be. for me al work ok. i test and all work. paste your binary file — RbMm, Oct 27 '17 at 17:55
@RbMm, [here is](https://www.sendspace.com/file/hnyrgi) compiled file. — , Oct 27 '17 at 18:00
@RbMm, ok. Now [see it](http://prntscr.com/h2uc8c). This is what happens here :-(. The first module should be **ntoskrnl.exe** right? — , Oct 27 '17 at 18:09
@JoãoPablo - you simply set too small console buffer size. you lost first records — RbMm, Oct 27 '17 at 18:12
@JoãoPablo - first of all you need be able to use debugger. know how output results. are you know how change console screen buffer size in menu ? in what problem. i already nothing say about your hard-code buffer size in code (this is absolute different) and very not optimized loop — RbMm, Oct 27 '17 at 18:18
@RbMm, yes solved! I used `SetConsoleScreenBufferSize()` function. — , Oct 27 '17 at 18:32

How list all modules of system (not modules of my own process)?

====================

====================

====================

0 Answers0