Support for modules of System process
FocuzJS opened this issue · comments
I'm trying to get the exports for win32kbase.sys and I'm not sure the best route to take.
I've tried reusing existing methods for getting a module list on the System process and its size is always 0, any advice?
As far as I know windows has PsLoadedModuleList. That's all my knowledge so far, will have to do some digging.
Implemented in 01799b6. However, I am yet to add appropriate HLAPI interfacing. From testing I have had the same results as you did, with only a few modules having any exports. As it turns out, win32kbase.sys was simply not loaded inside the kernel space, but rather inside the userspace processes. That, most likely, was the reason the export generation failed. Not closing until HLAPI reaches feature parity.