mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-08-22 23:14:59 +00:00
106 lines
2.5 KiB
C++
106 lines
2.5 KiB
C++
/**
|
|
* @file lm.cpp
|
|
* @author Sina Karvandi (sina@rayanfam.com)
|
|
* @brief lm command
|
|
* @details
|
|
* @version 0.1
|
|
* @date 2020-07-13
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#include "pch.h"
|
|
|
|
using namespace std;
|
|
|
|
/**
|
|
* @brief help of lm command
|
|
*
|
|
* @return VOID
|
|
*/
|
|
VOID CommandLmHelp() {
|
|
ShowMessages(
|
|
"lm : list kernel modules' base address, size, name and path.\n\n");
|
|
ShowMessages("syntax : \tlm [name]\n");
|
|
ShowMessages("\t\te.g : lm\n");
|
|
ShowMessages("\t\t\tdescription : list all modules\n");
|
|
ShowMessages("\t\te.g : lm nt\n");
|
|
ShowMessages("\t\t\tdescription : search and show all modules that contain "
|
|
"'nt' in their path or name\n");
|
|
}
|
|
|
|
/**
|
|
* @brief handle lm command
|
|
*
|
|
* @param SplittedCommand
|
|
* @return int
|
|
*/
|
|
int CommandLm(vector<string> SplittedCommand) {
|
|
|
|
PRTL_PROCESS_MODULES ModuleInfo;
|
|
NTSTATUS status;
|
|
ULONG i;
|
|
char *Search;
|
|
|
|
if (SplittedCommand.size() >= 3) {
|
|
ShowMessages("incorrect use of 'lm'\n\n");
|
|
CommandLmHelp();
|
|
return -1;
|
|
}
|
|
|
|
//
|
|
// Allocate memory for the module list
|
|
//
|
|
ModuleInfo = (PRTL_PROCESS_MODULES)VirtualAlloc(
|
|
NULL, 1024 * 1024, MEM_COMMIT | MEM_RESERVE,
|
|
PAGE_READWRITE);
|
|
|
|
if (!ModuleInfo) {
|
|
ShowMessages("\nUnable to allocate memory for module list (%d)\n",
|
|
GetLastError());
|
|
return -1;
|
|
}
|
|
|
|
//
|
|
// 11 = SystemModuleInformation
|
|
//
|
|
if (!NT_SUCCESS(status = NtQuerySystemInformation(
|
|
(SYSTEM_INFORMATION_CLASS)11, ModuleInfo, 1024 * 1024,
|
|
NULL)))
|
|
{
|
|
ShowMessages("\nError: Unable to query module list (%#x)\n", status);
|
|
|
|
VirtualFree(ModuleInfo, 0, MEM_RELEASE);
|
|
return -1;
|
|
}
|
|
|
|
ShowMessages("start\t\t\tsize\tname\t\tpath\n\n");
|
|
|
|
for (i = 0; i < ModuleInfo->NumberOfModules; i++) {
|
|
|
|
//
|
|
// Check if we need to search for the module or not
|
|
//
|
|
if (SplittedCommand.size() == 2) {
|
|
Search = strstr((char *)ModuleInfo->Modules[i].FullPathName,
|
|
SplittedCommand.at(1).c_str());
|
|
if (Search == NULL) {
|
|
|
|
//
|
|
// not found
|
|
//
|
|
continue;
|
|
}
|
|
}
|
|
|
|
ShowMessages("%016llx\t", ModuleInfo->Modules[i].ImageBase);
|
|
ShowMessages("%d\t", ModuleInfo->Modules[i].ImageSize);
|
|
|
|
ShowMessages("%s\t", ModuleInfo->Modules[i].FullPathName +
|
|
ModuleInfo->Modules[i].OffsetToFileName);
|
|
ShowMessages("%s\n", ModuleInfo->Modules[i].FullPathName);
|
|
}
|
|
|
|
VirtualFree(ModuleInfo, 0, MEM_RELEASE);
|
|
return 0;
|
|
}
|