CODEWITHSUNDEEP
windowswindows-server-2008windbgetwwindows-kernel
canzar
canzar

Reputation: 340

How do I get the address to kernel modules nt and win32k?

I need to know the base addresses where nt and win32k are loaded. I can find out this information by booting the system with kernel debugging enabled, start a kernel debug session, and run the command lm to get a list of the loaded modules.

What I want to do is programmatically determine where these two modules are loaded without booting into debug mode and using the kernel debugger. I need the base addresses for resolving syscalls in an Event Tracing for Windows log file.

The system I am working on is running Windows Server 2008 R2.

Upvotes: 8

Views: 5629

Answers (1)

Xearinox
Xearinox

Reputation: 3234

The list of loaded kernel modules and base addresses (including ntoskrnl) is stored in the list pointed by PsLoadedModuleList symbol. Or use ZwQuerySystemInformation(SystemModuleInformation) instead.

For detailed information see http://alter.org.ua/docs/nt_kernel/procaddr/

Upvotes: 12

Related Questions