在线枚举内核模块函数及地址（win64位）

#include <Windows.h>
#include <stdio.h>
#include <string>
#include <psapi.h>

#include "dbghelp.h"
//#include "imagehlp.h"
#pragma comment(lib,"dbghelp.lib")
#pragma comment(lib, "Imagehlp.lib")
extern "C" {

	PLOADED_IMAGE
		IMAGEAPI
		ImageLoad(
			PCSTR DllName,
			PCSTR DllPath
		);

	BOOL
		IMAGEAPI
		ImageUnload(
			PLOADED_IMAGE LoadedImage
		);

}
BOOL CALLBACK EnumSymCallBack(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext)
{
	if (strcmp((pSymInfo->Name), "NtUserSetImeInfoEx") == 0 )
	{
	}
	printf("%-100s :%p\n", pSymInfo->Name, pSymInfo->Address);
	return TRUE;
}

int main()
{
	std::string strMod;
	PVOID dwBaseAddr = 0;
	PVOID pDrvAddr[128 * 8];
	DWORD dwcbNeeded = 0;
	if (EnumDeviceDrivers(pDrvAddr, sizeof(pDrvAddr), &dwcbNeeded))
	{
		for (unsigned int i = 0; i<(dwcbNeeded / 8); i++)
		{
			LPSTR chDrvName[MAX_PATH];
			GetDeviceDriverBaseNameA(pDrvAddr[i], (LPSTR)chDrvName, MAX_PATH);
			dwBaseAddr = pDrvAddr[i];
			strMod = std::string((char*)chDrvName);
			printf("%-20s 0x%p\n", strMod.c_str(), dwBaseAddr);
			break;
		}
	}
	SymSetOptions(SYMOPT_DEFERRED_LOADS);
	HANDLE hProcess = GetCurrentProcess();
	//PLOADED_IMAGE   ploadImage = ImageLoad("win32k.sys", NULL); 
	PLOADED_IMAGE   ploadImage = ImageLoad("win32kbase.sys", NULL);
	SymInitialize(hProcess, 0, FALSE);
	std::string strSymbolPath = "srv*C:\\Windows\\symbols*http://msdl.microsoft.com/download/symbols";
	std::string strSystemPath = "C:\\Windows\\System32\\" + strMod;
	SymSetSearchPath(hProcess, strSymbolPath.c_str());
	HANDLE hSystemFile = CreateFileA(strSystemPath.c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL, OPEN_EXISTING, 0, NULL);
	DWORD dwFileSize = GetFileSize(hSystemFile, NULL);
	//当前模块
	//DWORD64 dwBase = SymLoadModule64(hProcess, NULL, strSystemPath.c_str(), NULL, (DWORD64)dwBaseAddr, dwFileSize);
	//win32k.sys模块
	DWORD64 dwBase = SymLoadModule64(hProcess, ploadImage->hFile, strSystemPath.c_str(), NULL, (DWORD64)dwBaseAddr, dwFileSize);
	printf("正在枚举符号...\n");
	SymEnumSymbols(hProcess, dwBase, 0, EnumSymCallBack, 0);
	printf("枚举符号结束...\n");
	SymUnloadModule64(hProcess, dwBase);
	SymCleanup(hProcess);
	system("pause");
	return 0;
}

需要三个 dll 及连网