public bool FdGetModuleList(IntPtr pid, out ModuleListItem[] result) { result = Array.Empty <ModuleListItem>(); ulong moduleListSize = FdGetModuleListSize(pid); if (moduleListSize <= 0) { return(false); } IntPtr moduleListPtr = MarshalUtility.AllocZeroFilled((int)moduleListSize); KERNEL_MODULE_LIST_REQUEST kmlr = new KERNEL_MODULE_LIST_REQUEST { ProcessId = pid, ModuleListPtr = (ulong)moduleListPtr.ToInt64(), ModuleListSize = moduleListSize }; IntPtr kmlrPointer = MarshalUtility.CopyStructToMemory(kmlr); int kmlrSize = Marshal.SizeOf <KERNEL_MODULE_LIST_REQUEST>(); if (DeviceIoControl(hDriver, IO_MODULE_LIST_REQUEST, kmlrPointer, kmlrSize, kmlrPointer, kmlrSize, IntPtr.Zero, IntPtr.Zero)) { kmlr = MarshalUtility.GetStructFromMemory <KERNEL_MODULE_LIST_REQUEST>(kmlrPointer); if (kmlr.ModuleListCount > 0) { byte[] managedBuffer = new byte[moduleListSize]; Marshal.Copy(moduleListPtr, managedBuffer, 0, (int)moduleListSize); Marshal.FreeHGlobal(moduleListPtr); result = new ModuleListItem[kmlr.ModuleListCount]; using (BinaryReader reader = new BinaryReader(new MemoryStream(managedBuffer))) { for (int i = 0; i < result.Length; i++) { result[i] = ModuleListItem.FromByteStream(reader); } } return(true); } } return(false); }
public bool FdGetProcessList(out ProcessListItem[] result) { result = Array.Empty <ProcessListItem>(); ulong processListSize = FdGetProcessListSize(); if (processListSize <= 0) { return(false); } IntPtr processListPtr = MarshalUtility.AllocZeroFilled((int)processListSize); KERNEL_PROCESS_LIST_REQUEST kplr = new KERNEL_PROCESS_LIST_REQUEST { ProcessListPtr = (ulong)processListPtr.ToInt64(), ProcessListSize = processListSize }; IntPtr kplrPointer = MarshalUtility.CopyStructToMemory(kplr); int klprSize = Marshal.SizeOf <KERNEL_PROCESS_LIST_REQUEST>(); if (DeviceIoControl(hDriver, IO_PROCESS_LIST_REQUEST, kplrPointer, klprSize, kplrPointer, klprSize, IntPtr.Zero, IntPtr.Zero)) { kplr = MarshalUtility.GetStructFromMemory <KERNEL_PROCESS_LIST_REQUEST>(kplrPointer); if (kplr.ProcessListCount > 0) { byte[] managedBuffer = new byte[processListSize]; Marshal.Copy(processListPtr, managedBuffer, 0, (int)processListSize); Marshal.FreeHGlobal(processListPtr); result = new ProcessListItem[kplr.ProcessListCount]; using (BinaryReader reader = new BinaryReader(new MemoryStream(managedBuffer))) { for (int i = 0; i < result.Length; i++) { result[i] = ProcessListItem.FromByteStream(reader); } } return(true); } } return(false); }