Add a POC for windows.system.modules to replace winutils.get_kernel_modules()

windows/winobject/system.py

@@ -20,6 +20,7 @@ from windows.winobject import kernobj
 from windows.winobject import handle
 from windows.winobject import event_log
 from windows.winobject import task_scheduler
+from windows.winobject import system_module
 
 from windows.generated_def.winstructs import *
 from windows.dbgprint import dbgprint
@@ -70,6 +71,11 @@ class System(object):
         :type: [:class:`~windows.winobject.handle.Handle`] -- A list of Hanlde"""
         return handle.enumerate_handles()
 
+    @property
+    def modules(self):
+        # TODO: doc
+        return system_module.enumerate_kernel_modules()
+
     @utils.fixedpropety
     def bitness(self):
         """The bitness of the system
@@ -237,6 +243,8 @@ class System(object):
         # This returns the last version where ntdll was updated
         # Should look at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
         # values:  CurrentBuild + UBR
+        # windows.system.registry(r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion")["CurrentBuild"].value
+        # windows.system.registry(r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion")["UBR"].value
         return self.get_file_version("comctl32")
 
     @staticmethod

windows/winobject/system_module.py

@@ -0,0 +1,39 @@
+import ctypes
+
+import windows
+import windows.winproxy as winproxy
+import windows.generated_def as gdef
+
+class BaseSystemModule(object):
+    def __repr__(self):
+        return """<{0} name="{1}" base={2:#x}>""".format(type(self).__name__, self.ImageName, self.Base)
+
+
+class SystemModule(BaseSystemModule, gdef.SYSTEM_MODULE):
+    pass
+
+
+# Only useful / meaningful in Wow64 Process
+class SystemModuleWow64(BaseSystemModule, gdef.SYSTEM_MODULE64):
+    pass
+
+
+def enumerate_kernel_modules():
+    if windows.current_process.is_wow_64:
+        return enumerate_kernel_modules_syswow64()
+    cbsize = gdef.DWORD()
+    winproxy.NtQuerySystemInformation(gdef.SystemModuleInformation, None, 0, ctypes.byref(cbsize))
+    raw_buffer = (cbsize.value * gdef.BYTE)()
+    buffer = gdef.SYSTEM_MODULE_INFORMATION.from_address(ctypes.addressof(raw_buffer))
+    winproxy.NtQuerySystemInformation(gdef.SystemModuleInformation, ctypes.byref(raw_buffer), ctypes.sizeof(raw_buffer), ctypes.byref(cbsize))
+    modules = (SystemModule * buffer.ModulesCount).from_address(ctypes.addressof(buffer) + gdef.SYSTEM_MODULE_INFORMATION.Modules.offset)
+    return list(modules)
+
+def enumerate_kernel_modules_syswow64():
+    cbsize = gdef.DWORD()
+    windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemModuleInformation, None, 0, ctypes.addressof(cbsize))
+    raw_buffer = (cbsize.value * gdef.BYTE)()
+    buffer = gdef.SYSTEM_MODULE_INFORMATION64.from_address(ctypes.addressof(raw_buffer))
+    windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemModuleInformation, ctypes.byref(raw_buffer), ctypes.sizeof(raw_buffer), ctypes.byref(cbsize))
+    modules = (SystemModuleWow64 * buffer.ModulesCount).from_address(ctypes.addressof(buffer) + gdef.SYSTEM_MODULE_INFORMATION64.Modules.offset)
+    return list(modules)