Just For Ci :system Loaded Modules

السلام عليكم

الكود الأتي يعطي قائمة بـSystem Loaded Modules وبعض المعلومات عنها .

الكود يستعمل الداله NtQuerySystemInformation وبعض التراكيب التي يمكن الاطلاع على معلومات اكثر عنها بالرجوع الى كتاب Gary Nebbett المسمى "Windows NT/2000 Native API ".

Just for NT/2K/XP . Tested in WINXP .

//--------------------------------------------------------

Add Button & ListView to a form

 
const 
STATUS_INFO_LENGTH_MISMATCH=$C0000004; 
SystemModuleInformation=11; 
... 
  Type 
  USHORT=WORD; 
  TSystem_Module_Information=packed record 
        Base:Pointer; 
        Size:ULONG; 
        Flags:ULONG; 
        Index:USHORT; 
        Unknown:USHORT; 
        LoadCount:USHORT; 
        ModuleNameOffset:USHORT; 
        ImageName: array [0..MAX_PATH + 3] of Char; 
  end; 
  PSystem_Module_Information=^TSystem_Module_Information; 
... 
function  NtQuerySystemInformation  (infoClass: DWORD; 
  buffer: Pointer; 
  bufSize: DWORD; 
  returnSize: PDword): DWORD; stdcall; external'ntdll.dll' name 'NtQuerySystemInformation'; 
... 
procedure GetDriverInfo(MyListView:TListView); 
  var 
    Index, numEntries: DWORD; 
    driverInfo,p: PSystem_Module_Information; 
    ListItem: TListItem; 
    ret,Size: DWORD; 
    NewColumn: TListColumn; 
begin 
  Size:=sizeof(TSystem_Module_Information); 
  driverInfo:=allocMem( Size); 
  ret := NtQuerySystemInformation(11, 
  driverInfo, Size, nil); 
  while ret = STATUS_INFO_LENGTH_MISMATCH do 
  begin 
    Inc(Size, Size); 
    ReallocMem(driverInfo, Size); 
    ret := NtQuerySystemInformation(SystemModuleInformation, 
   driverInfo, Size, nil); 
  end; 
   p:=driverInfo; 
   numEntries:=ULONG(driverInfo.base); 
   driverInfo:=PSystem_Module_Information(ULONG(driverInfo)+12); 
   //why 12? ;-)   wanna know ? check Nebbett's book. 
   with MyListView do 
   begin 
     // You can do this in the design time 
     Align:=alLeft; 
     ViewStyle:=VsReport; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'Base'; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'Size'; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'Flags'; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'Index'; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'Unknown'; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'LoadCount'; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'NameOffset'; 
     NewColumn := Columns.Add; 
     NewColumn.Caption := 'Name'; 
     for Index := 1 to numEntries do 
     begin 
        ListItem := Items.Add; 
        ListItem.Caption := IntToHex(DWORD(driverInfo.Base),8); 
        ListItem.SubItems.Add(IntToStr(DriverInfo.Size)); 
        ListItem.SubItems.Add(IntToStr(DriverInfo.Flags)); 
        ListItem.SubItems.Add(IntToStr(DriverInfo.Index)); 
        ListItem.SubItems.Add(IntToStr(DriverInfo.Unknown)); 
        ListItem.SubItems.Add(IntToStr(DriverInfo.LoadCount)); 
        ListItem.SubItems.Add(IntToStr(DriverInfo.ModuleNameOffset)); 
        ListItem.SubItems.Add(DriverInfo.ImageName); 
        driverInfo:=PSystem_Module_Information( 
        ULONG(driverInfo)+sizeof(TSystem_Module_Information)); 
     end; 
    end; 
    driverInfo:=p;   // <---why? check delphi help "FreeMem procedure". 
    FreeMem(driverInfo); 
end; 
//-------------------------------------------------------------- 
procedure TForm1.Button1Click(Sender: TObject); 
begin 
  GetDriverInfo(ListView1); 
end;

(f)

CIONO1