mirror of
https://github.com/BeneficialCode/WinArk.git
synced 2026-10-18 05:36:10 +08:00
BeneficialCode
35 lines
890 B
C++
35 lines
890 B
C++
#pragma once
|
|
|
|
#include <string>
|
|
|
|
namespace WinSys {
|
|
struct KernelModuleInfo {
|
|
std::string Name;
|
|
std::string FullPath;
|
|
std::string NtPath;
|
|
HANDLE hSection;
|
|
void* MappedBase;
|
|
void* ImageBase;
|
|
uint32_t ImageSize;
|
|
uint32_t Flags;
|
|
uint16_t LoadOrderIndex;
|
|
uint16_t InitOrderIndex;
|
|
uint16_t LoadCount;
|
|
void* DefaultBase;
|
|
uint32_t ImageChecksum;
|
|
uint32_t TimeDateStamp;
|
|
};
|
|
|
|
class KernelModuleTracker final {
|
|
public:
|
|
uint32_t EnumModules();
|
|
|
|
const std::vector<std::shared_ptr<KernelModuleInfo>>& GetModules() const;
|
|
const std::vector<std::shared_ptr<KernelModuleInfo>>& GetNewModules() const;
|
|
const std::vector<std::shared_ptr<KernelModuleInfo>>& GetUnloadModules() const;
|
|
|
|
private:
|
|
std::vector<std::shared_ptr<KernelModuleInfo>> _modules, _newModules, _unloadModules;
|
|
const std::unordered_map<void*, std::shared_ptr<KernelModuleInfo>> _moduleMap;
|
|
};
|
|
} |