A documented way to get loaded modules
This is a new one on me. I just saw this mentioned on NTDEV for the first time yesterday. AuxKlibQueryModuleInformation is a documented way to get the loaded modules, replacing some of the functionality of ZwQuerySystemInformation.
In fact, the entire Auxiliary Kernel-Mode Library Routines section is interesting. I had no idea it existed until now. Other exports include AuxKlibGetImageExportDirectory and AuxKlibGetBugCheckData.
Doron Holan says that it’s backward-compatible all the way to Windows 2000 via a static library, in a similar manner to cancel-safe queues and the safe string library.
Neato.
April 5th, 2008 at 3:05 pm
Hmmm… It seems as though the actual library available for download does not export AuxKlibGetImageExportDirectory and AuxKlibGetBugCheckData…
-Steve Cleary