usermode

#include <stdio.h>
#include <conio.h>
#include <Windows.h>
#include <winternl.h>

#pragma comment(lib,"ntdll.lib")

typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
    HANDLE Section;
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    CHAR FullPathName[256];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;

typedef struct _RTL_PROCESS_MODULES
{
    ULONG NumberOfModules;
    RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

typedef BOOL (WINAPI *LPFN_Wow64DisableWow64FsRedirection)(PVOID* OldValue);
typedef BOOL (WINAPI *LPFN_Wow64RevertWow64FsRedirection)(PVOID OldValue);

PVOID OldValue;

BOOL IsWow64()
{
    BOOL bIsWow64 = FALSE;

    typedef BOOL (WINAPI *LPFN_ISWOW64PROCESS) (HANDLE, PBOOL);
    LPFN_ISWOW64PROCESS fnIsWow64Process;
    fnIsWow64Process = (LPFN_ISWOW64PROCESS) GetProcAddress( GetModuleHandle("kernel32"),"IsWow64Process");

    if(NULL != fnIsWow64Process)
    {
        if (!fnIsWow64Process(GetCurrentProcess(),&bIsWow64))
        {
            //handle error
        }
    }
    return bIsWow64;
}

int main()
{

    COORD c;
    c.X=2200;
    c.Y=3200;
    SetConsoleScreenBufferSize(GetStdHandle(STD_OUTPUT_HANDLE),c);

    LPFN_Wow64DisableWow64FsRedirection pfnWow64DisableWowFsRedirection = (LPFN_Wow64DisableWow64FsRedirection)GetProcAddress(GetModuleHandle("kernel32"),"Wow64DisableWow64FsRedirection");
    LPFN_Wow64RevertWow64FsRedirection pfnWow64RevertWow64FsRedirection = (LPFN_Wow64RevertWow64FsRedirection)GetProcAddress(GetModuleHandle("kernel32"),"Wow64RevertWow64FsRedirection");

    //------------------------------------

    HANDLE hFile, hFileMap;
    LPVOID pMappedFile;
    PIMAGE_DOS_HEADER pDosh;
    PIMAGE_NT_HEADERS pPeh;

    //------------------------------------

    NTSTATUS status;
    ULONG i;

    PRTL_PROCESS_MODULES ModuleInfo;

    ModuleInfo=(PRTL_PROCESS_MODULES)VirtualAlloc(NULL,1024*1024,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); // Allocate memory for the module list

    if(!ModuleInfo)
    {
        printf("\nUnable to allocate memory for module list (%d)\n",GetLastError());
        return -1;
    }

    if(!NT_SUCCESS(status=NtQuerySystemInformation((SYSTEM_INFORMATION_CLASS)11,ModuleInfo,1024*1024,NULL))) // 11 = SystemModuleInformation
    {
        printf("\nError: Unable to query module list (%#x)\n",status);

        VirtualFree(ModuleInfo,0,MEM_RELEASE);
        return -1;
    }

    for(i=0;i<ModuleInfo->NumberOfModules;i++)
    {

        if(strcmpi("win32k.sys", ModuleInfo->Modules[i].FullPathName+ModuleInfo->Modules[i].OffsetToFileName) == 0)
        {

            if(IsWow64())
            {
                if (pfnWow64DisableWowFsRedirection && pfnWow64RevertWow64FsRedirection)
                {
                    if(TRUE == pfnWow64DisableWowFsRedirection(&OldValue))
                    {

                        hFile = CreateFile ("C:\\Windows\\System32\\win32k.sys", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
                            FILE_ATTRIBUTE_NORMAL, 0);

                        pfnWow64RevertWow64FsRedirection(OldValue);
                    }
                }
            }
            else
            {
                hFile = CreateFile ("C:\\Windows\\System32\\win32k.sys", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
                    FILE_ATTRIBUTE_NORMAL, 0);
            }

            if (hFile == INVALID_HANDLE_VALUE)
            {
                MessageBox(0, "Cannot open file!", "Error", MB_ICONERROR);
                ExitProcess(0);
            }

            hFileMap = CreateFileMapping (hFile, NULL, PAGE_READONLY, 0, 0, NULL);
            if (!hFileMap)
            {
                CloseHandle(hFile);
                ExitProcess(0);
            }
            pMappedFile = MapViewOfFile ( hFileMap, FILE_MAP_READ, 0, 0, 0);
            if (!pMappedFile)
            {
                CloseHandle(hFileMap);
                CloseHandle(hFile);
                ExitProcess(0);
            }

            pDosh = (PIMAGE_DOS_HEADER)pMappedFile;br />            pPeh  = (PIMAGE_NT_HEADERS)((DWORD)pMappedFile + pDosh->e_lfanew);

            printf("\n*****************************************************\n");
            printf("\nBase address: 0x%p\n",ModuleInfo->Modules[i].ImageBase);
            printf("\nImage Base: 0x%p\n",pPeh->OptionalHeader.ImageBase);
            printf("\nImage name: %s\n",ModuleInfo->Modules[i].FullPathName+ModuleInfo->Modules[i].OffsetToFileName);
            printf("\nImage full path: %s\n",ModuleInfo->Modules[i].FullPathName);
            printf("\nImage size: %d\n",ModuleInfo->Modules[i].ImageSize);
            printf("\n*****************************************************\n");

            break;

        }
    }

    VirtualFree(ModuleInfo,0,MEM_RELEASE);
    UnmapViewOfFile(pMappedFile);
    CloseHandle(hFileMap);
    CloseHandle(hFile);

    getch();
    return 0;
}