поиск базы кернел

.686
.model flat,stdcall
option casemap:none
 
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\rtl.inc
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
 
.data
fmt db '0x%X',0
 
.data?
stdin dd ?
stdout dd ?
 
.code
 
start proc
local cbytes:dword
local ir:INPUT_RECORD
local buffer[256]:byte
 
invoke AllocConsole
 
mov ebx,fs:[30h]
mov ecx,(PEB ptr [ebx]).ProcessParameters
mov eax,(RTL_USER_PROCESS_PARAMETERS ptr [ecx]).StdOutputHandle
mov stdout,eax
mov eax,(RTL_USER_PROCESS_PARAMETERS ptr [ecx]).StdInputHandle
mov stdin,eax
mov edi,(RTL_USER_PROCESS_PARAMETERS ptr [ecx]).CommandLine.Buffer
movzx ecx,(RTL_USER_PROCESS_PARAMETERS ptr [ecx]).CommandLine.Len
mov dword ptr [edi+ecx],0a000dh
;invoke WriteConsoleW,stdout,edi,ecx,addr cbytes,0
 
mov ebx,(PEB ptr [ebx]).Ldr
mov ebx,(PEB_LDR_DATA ptr [ebx]).InLoadOrderModuleList.Flink
 
mov ebx,(LDR_DATA_TABLE_ENTRY ptr [ebx]).InLoadOrderModuleLinks.Flink
mov esi,ebx
@@:
push esi
mov esi,(LDR_DATA_TABLE_ENTRY ptr [ebx]).BaseDllName.Buffer
invoke lstrlenW,esi
test eax,eax
je @1
mov ecx,eax
push ecx
lea edi,buffer
rep movsw
mov dword ptr [edi],0a000dh
pop ecx
pop esi
add ecx,2
invoke WriteConsoleW,stdout,addr buffer,ecx,addr cbytes,0
 
mov edi,(LDR_DATA_TABLE_ENTRY ptr [ebx]).DllBase
invoke wsprintf,addr buffer,addr fmt,edi
mov ecx,eax
mov word ptr [ecx+buffer],0a0dh
add ecx,2
invoke WriteConsole,stdout,addr buffer,ecx,addr cbytes,0
@1:
mov ebx,(LDR_DATA_TABLE_ENTRY ptr [ebx]).InLoadOrderModuleLinks.Flink
cmp ebx,esi
jnz @b
 
@@:
invoke ReadConsoleInput,stdin,addr ir,sizeof ir,addr cbytes
cmp ir.KeyEvent.AsciiChar,1bh
jnz @b
 
invoke FreeConsole
invoke ExitProcess,0
start endp
end start