[fsdhook]

Hi, we all know that we can use EnumDeviceDrivers or ZwQuerySystemInformation to get driver base address.
But is it possible to get driver base address in WIN64 system by a 32-bit process? NOT USE DRIVER.

[EP_X0FF]

https://github.com/rwfpl/rewolf-wow64ext

[cziter15]

https://github.com/rwfpl/rewolf-wow64ext

I've had few problems on few machines. It was crashing at X64Call on few Win8 machines.
Anyway, another solution is to call NtWow64GetNativeSystemInformation.

Code: Select all

NTSTATUS NTAPI
NtWow64GetNativeSystemInformation(
     SYSTEM_INFORMATION_CLASS SystemInformationClass,
     PVOID SystemInformation,
     ULONG SystemInformationLength,
     PULONG ReturnLength
);

Code: Select all

typedef NTSTATUS (NTAPI *tNtWow64GetNativeSystemInformation)
(
     SYSTEM_INFORMATION_CLASS SystemInformationClass,
     PVOID SystemInformation,
     ULONG SystemInformationLength,
     PULONG ReturnLength
);

tNtWow64GetNativeSystemInformation NtWow64GetNativeSystemInformation = (tNtWow64GetNativeSystemInformation)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtWow64GetNativeSystemInformation");

if (NtWow64GetNativeSystemInformation != NULL)
{
      NtWow64GetNativeSystemInformation(.....); //call it like NtQuerySystemInformation
}
else
{
      OutputDebugStringW(L"We are not on WOW64 !!");
}

This function is exported by wow64 ntdll.dll, get it's pointer using GetProcAddress.

You have to use X64 variable to get driver base address (use ULONGLONG instead of PVOID, which has 4 byte in 32bit process)

[Brock]

@cziter15,

NtWow64GetNativeSystemInformation() doesn't work with SystemModuleInformation (enum ordinal value 11) from a 32-bit (WOW64) process on any 64-bit OS I've ever tried. You'll get STATUS_INVALID_INFO_CLASS (0xC0000003) since it's not implemented through the WOW layer. Do I appear to be missing an important detail if you're somehow succeeding? Only a few select classes are actually implemented through WOW and unfortunately SystemModuleInformation doesn't seem to be one of them

Best Regards,
Brock