Fixup the kernel module list error on Windows 7 x64.

WinSysCore/KernelModuleTracker.cpp

@@ -1,5 +1,7 @@
 #include "pch.h"
 #include "KernelModuleTracker.h"
+#include <PEParser.h>
+#include "Helpers.h"
 
 using namespace WinSys;
 
@@ -8,6 +10,13 @@ uint32_t WinSys::KernelModuleTracker::EnumModules() {
 	DWORD size = 1 << 18;
 	wil::unique_virtualalloc_ptr<> buffer(::VirtualAlloc(nullptr, size,MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE));
 
+	PVOID SystemRangeStart = 0;
+	NtQuerySystemInformation(SystemRangeStartInformation,
+		&SystemRangeStart,
+		sizeof(SystemRangeStart),
+		NULL);
+	
+
 	NTSTATUS status;
 	status = ::NtQuerySystemInformation(SystemModuleInformationEx, buffer.get(), size, nullptr);
 	if (!NT_SUCCESS(status))
@@ -22,7 +31,7 @@ uint32_t WinSys::KernelModuleTracker::EnumModules() {
 	::GetWindowsDirectoryA(winDir, _countof(winDir));
 	static const std::string root("\\SystemRoot\\");
 	static const std::string global("\\??\\");
-
+	
 	for (;;) {
 		if (p->BaseInfo.ImageBase == 0)
 			break;
@@ -34,6 +43,26 @@ uint32_t WinSys::KernelModuleTracker::EnumModules() {
 			m->FullPath = m->FullPath.substr(global.size());
 		if (m->FullPath.find(root) == 0)
 			m->FullPath = winDir + m->FullPath.substr(root.size() - 1);
+
+		if (p->BaseInfo.ImageBase < SystemRangeStart) {
+			if (p->NextOffset == 0)
+				break;
+			p = (RTL_PROCESS_MODULE_INFORMATION_EX*)((BYTE*)p + p->NextOffset);
+			continue;
+		}
+
+		std::wstring path = Helpers::StringToWstring(m->FullPath);
+		PEParser parser(path.c_str());
+		if (parser.IsValid()) {
+			auto type = parser.GetSubsystemType();
+			if (type != SubsystemType::Native) {
+				if (p->NextOffset == 0)
+					break;
+				p = (RTL_PROCESS_MODULE_INFORMATION_EX*)((BYTE*)p + p->NextOffset);
+				continue;
+			}
+		}
+		
 		m->ImageBase = p->BaseInfo.ImageBase;
 		m->MappedBase = p->BaseInfo.MappedBase;
 		m->ImageSize = p->BaseInfo.ImageSize;