public bool FdGetModuleList(IntPtr pid, out ModuleListItem[] result)
{
result = Array.Empty <ModuleListItem>();
ulong moduleListSize = FdGetModuleListSize(pid);
if (moduleListSize <= 0)
{
return(false);
}
IntPtr moduleListPtr = MarshalUtility.AllocZeroFilled((int)moduleListSize);
KERNEL_MODULE_LIST_REQUEST kmlr = new KERNEL_MODULE_LIST_REQUEST
{
ProcessId = pid,
ModuleListPtr = (ulong)moduleListPtr.ToInt64(),
ModuleListSize = moduleListSize
};
IntPtr kmlrPointer = MarshalUtility.CopyStructToMemory(kmlr);
int kmlrSize = Marshal.SizeOf <KERNEL_MODULE_LIST_REQUEST>();
if (DeviceIoControl(hDriver, IO_MODULE_LIST_REQUEST, kmlrPointer, kmlrSize, kmlrPointer, kmlrSize, IntPtr.Zero, IntPtr.Zero))
{
kmlr = MarshalUtility.GetStructFromMemory <KERNEL_MODULE_LIST_REQUEST>(kmlrPointer);
if (kmlr.ModuleListCount > 0)
{
byte[] managedBuffer = new byte[moduleListSize];
Marshal.Copy(moduleListPtr, managedBuffer, 0, (int)moduleListSize);
Marshal.FreeHGlobal(moduleListPtr);
result = new ModuleListItem[kmlr.ModuleListCount];
using (BinaryReader reader = new BinaryReader(new MemoryStream(managedBuffer)))
{
for (int i = 0; i < result.Length; i++)
{
result[i] = ModuleListItem.FromByteStream(reader);
}
}
return(true);
}
}
return(false);
}
private ulong FdGetModuleListSize(IntPtr pid)
{
KERNEL_MODULE_LIST_REQUEST kmlr = new KERNEL_MODULE_LIST_REQUEST
{
ProcessId = pid,
};
IntPtr kmlrPointer = MarshalUtility.CopyStructToMemory(kmlr);
int kmlrSize = Marshal.SizeOf <KERNEL_MODULE_LIST_REQUEST>();
if (DeviceIoControl(hDriver, IO_MODULE_LIST_REQUEST, kmlrPointer, kmlrSize, kmlrPointer, kmlrSize, IntPtr.Zero, IntPtr.Zero))
{
kmlr = MarshalUtility.GetStructFromMemory <KERNEL_MODULE_LIST_REQUEST>(kmlrPointer);
return(kmlr.ModuleListSize);
}
return(0);
}
