Source code for windows.winobject.system_module
import ctypes
import windows
import windows.winproxy as winproxy
import windows.generated_def as gdef
[docs]
class BaseSystemModule(object):
"""[ABSTRACT] A common base class for all system modules"""
@property
def name(self):
"""The name of the system module: alias for ``ImageName``"""
return self.ImageName
def __repr__(self):
return """<{0} name="{1}" base={2:#x}>""".format(type(self).__name__, self.ImageName, self.Base)
[docs]
class SystemModule(BaseSystemModule, gdef.SYSTEM_MODULE):
"""A system module.
.. note::
inherit from SYSTEM_MODULE[32/64] based on the current process bitness
"""
pass
# Only useful / meaningful in Wow64 Process
[docs]
class SystemModuleWow64(BaseSystemModule, gdef.SYSTEM_MODULE64):
"""An explicite 64b system module for SysWow64 processes"""
pass
def enumerate_kernel_modules():
if windows.current_process.is_wow_64:
return enumerate_kernel_modules_syswow64()
cbsize = gdef.DWORD()
winproxy.NtQuerySystemInformation(gdef.SystemModuleInformation, None, 0, ctypes.byref(cbsize))
raw_buffer = (cbsize.value * gdef.BYTE)()
buffer = gdef.SYSTEM_MODULE_INFORMATION.from_address(ctypes.addressof(raw_buffer))
winproxy.NtQuerySystemInformation(gdef.SystemModuleInformation, ctypes.byref(raw_buffer), ctypes.sizeof(raw_buffer), ctypes.byref(cbsize))
modules = (SystemModule * buffer.ModulesCount).from_buffer(raw_buffer, gdef.SYSTEM_MODULE_INFORMATION.Modules.offset)
return list(modules)
def enumerate_kernel_modules_syswow64():
cbsize = gdef.DWORD()
windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemModuleInformation, None, 0, ctypes.addressof(cbsize))
raw_buffer = (cbsize.value * gdef.BYTE)()
buffer = gdef.SYSTEM_MODULE_INFORMATION64.from_address(ctypes.addressof(raw_buffer))
windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemModuleInformation, ctypes.byref(raw_buffer), ctypes.sizeof(raw_buffer), ctypes.byref(cbsize))
modules = (SystemModuleWow64 * buffer.ModulesCount).from_buffer(raw_buffer, gdef.SYSTEM_MODULE_INFORMATION64.Modules.offset)
return list(modules)