Re: Subject: Kernel Module Base address

NTDEV
1

Hi.

Use ZwQuerySystemInformation. For detalis see
Nebbett’s “Win NT / 2000 Native API reference” . If
dont feel like buying the book Ill past the prototypes
and associated data structures for you. But you should
since is one of the few books wich worths the money
spent on them. (altough is nothing but a reference)
Another method would be to walk yourself
_PsLoadedModuleList list. This is quite a mess , and
one has very few reasons to do this. So stick to API.

Do You Yahoo!?
Yahoo! Auctions - Buy the things you want at great prices.
http://auctions.yahoo.com/

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Catched!

So I only need to walk all the Driver_Object linked list to
access the information. But where can I get the head of the
linked list of the Driver_Object.

It is documented somewhere? Did I missed something?

Guy

> How can I retreive from a kernel driver the kernel drivers
and modules
> bases addresses.

Try DRIVER_OBJECT::DriverStart

Max

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com