{"id":35,"date":"2006-10-02T00:55:48","date_gmt":"2006-10-02T00:55:48","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2006\/10\/02\/rtlgetmodulebase-rtlgetprocaddress\/"},"modified":"2026-07-24T18:27:23","modified_gmt":"2026-07-24T18:27:23","slug":"rtlgetmodulebase-rtlgetprocaddress","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2006\/10\/02\/rtlgetmodulebase-rtlgetprocaddress\/","title":{"rendered":"RtlGetModuleBase & RtlGetProcAddress"},"content":{"rendered":"
\"\"<\/a><\/div>\n

In the post ExAllocatePool (WithoutTag)<\/a>, I talked a little about the conflicts on using new APIs in drivers and making them incompatible with legacy systems.\u00a0Our initial proposal was to have a single binary that would be able to run either in Windows NT and newer systems.\u00a0We reached a solution that cannot be considered ideal, that old functions are\u00a0always used on systems that support newer APIs.<\/p>\n

Thinking about solving this limitation, the DDK brought us MmGetSystemRoutineAddress()<\/a>.\u00a0Analogous to GetProcAddress()<\/a> exported by kernel32.dll, MmGetSystemRoutineAddress()<\/em> dynamically obtains a function\u00a0address from its exported name.\u00a0But the world will not still be safe while Windows NT survives.\u00a0This new function has only been implemented since Windows 2000.<\/p>\n

We don’t have an alternative to Windows NT, so let’s make one.\u00a0With one or two PE concepts, we implemented this function version. PE\u00a0structure carries tons of rules, but for our need we can implement a light version.\u00a0If you want details about the rules adopted by PE, you can take a look at the article An In-Depth Look into the Win32 Portable Executable File Format<\/a> by Matt Pietrek.<\/p>\n

Well, now that we already have read the entire article and already known everything about PE, follow the basic algorithm\u00a0prototype about how to walk through PE\u00a0structure, looking for a specific function exported by name.\u00a0This function is not provided by Windows NT DDK and is written in the example\u00a0source code available for downloading.<\/p>\n

\n
NTSTATUS RtlGetProcAddress(IN PVOID\u00a0\u00a0\u00a0\u00a0 pBaseAddress,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0 IN LPCSTR\u00a0\u00a0\u00a0 pszFunctionName,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0 IN NTPROC\u00a0\u00a0\u00a0 *pProcedure);<\/pre>\n<\/div>\n
Notice that the input parameters are the base address, the name of desired function and ultimately the address to the pointer that will get the obtained function\u00a0address.\u00a0But where will I get this base address from?\u00a0Remember the functions we are looking for are exported by ntoskrnl.lib<\/strong> and they are implemented in the ntoskrnl.exe<\/strong> module.\u00a0To make sure the function we’re looking for is in fact exported by this module, use the “Dependency Walker”<\/em> to see this module\u00a0export table.\u00a0As I said before, some functions are implemented as macros, thus, its definition will be in a header\u00a0file and not in the export table.<\/p>\n
\"\"<\/div>\n
To get the module\u00a0base address that exports these functions, we use ZwQuerySystemInformation()<\/a> in which, although not documented by Microsoft, there are already several publications that comment about it.\u00a0Thus, we’ll define the RtlGetModuleBase()<\/strong> which will behave similar to the well-known GetModuleHandle()<\/a>.\u00a0This function is also defined in the example available for downloading.<\/p>\n
\n
NTSTATUS<\/pre>\n
NTAPI<\/pre>\n
ZwQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN OUT PVOID SystemInformation,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN ULONG SystemInformationLength,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OUT PULONG ReturnLength OPTIONAL)<\/pre>\n<\/div>\n
There are many undocumented features and settings that can be extremely useful.\u00a0The book Windows NT\/2000 Native API Reference<\/a> by Gary Nebbett is excellent to make use of these functions. He brings prototypes, enums, structures used in calls, descriptions of what each function does and each parameter.\u00a0Here in our example, we only use the statements below for information about the modules loaded into the system\u00a0address space.<\/p>\n
\n
typedef<\/span> struct<\/span> _SYSTEM_MODULE_INFORMATION\u00a0\u00a0 \/\/ Information Class 11<\/span><\/pre>\n
{<\/pre>\n
\u00a0\u00a0\u00a0 ULONG Reserved[2<\/span>];<\/pre>\n
\u00a0\u00a0\u00a0 PVOID Base;<\/pre>\n
\u00a0\u00a0\u00a0 ULONG Size;<\/pre>\n
\u00a0\u00a0\u00a0 ULONG Flags;<\/pre>\n
\u00a0\u00a0\u00a0 USHORT Index;<\/pre>\n
\u00a0\u00a0\u00a0 USHORT Unknown;<\/pre>\n
\u00a0\u00a0\u00a0 USHORT LoadCount;<\/pre>\n
\u00a0\u00a0\u00a0 USHORT ModuleNameOffset;<\/pre>\n
\u00a0\u00a0\u00a0 CHAR ImageName[256<\/span>];<\/pre>\n
\u00a0<\/pre>\n
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;<\/pre>\n<\/div>\n
The structure\u00a0“Base”\u00a0member above brings us the module\u00a0base address containing PE structure.\u00a0In the sample code, \u00a0is RtlGetModuleBase()<\/strong> routine\u00a0definition that has the following prototype.<\/p>\n
\n
NTSTATUS RtlGetModuleBase(IN LPCSTR\u00a0\u00a0\u00a0\u00a0 pszModuleName,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 OUT PVOID*\u00a0\u00a0\u00a0 ppBaseAddress);<\/pre>\n<\/div>\n
With the union of its powers, now we can know whether a certain API is implemented in the current system and if so, get its address.\u00a0So, it is perfectly possible to have a single binary that can run on both Windows NT using ExFreePool()<\/a> and in later systems using ExFreePoolWithTag()<\/a>.\u00a0Below it is a very basic example as always.\u00a0Of course, we can create a single allocation routine that would do the dirty work.<\/p>\n
\n
#include<\/span> \"GetProcAddr.h\"<\/span><\/pre>\n
\u00a0<\/pre>\n
\/\/-f--> Type for the ExFreePoolWithTag routine<\/span><\/pre>\n
typedef<\/span> VOID (NTAPI* PF_EX_FREE_POOL_WITH_TAG)<\/pre>\n
(<\/pre>\n
\u00a0\u00a0\u00a0 IN PVOID\u00a0 P,<\/pre>\n
\u00a0\u00a0\u00a0 IN ULONG\u00a0 Tag <\/pre>\n
);<\/pre>\n
\u00a0<\/pre>\n
\u00a0<\/pre>\n
VOID OnDriverUnload(PDRIVER_OBJECT\u00a0\u00a0\u00a0\u00a0 pDriverObj)<\/pre>\n
{<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> That routine, even empty, is here just<\/span><\/pre>\n
\u00a0\u00a0\u00a0 \/\/\u00a0\u00a0\u00a0\u00a0\u00a0 to allow the driver to be unloaded.<\/span><\/pre>\n
}<\/pre>\n
\u00a0<\/pre>\n
\u00a0<\/pre>\n
\/****<\/span><\/pre>\n
***<\/span><\/pre>\n
**\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0 There once was a Driver...<\/span><\/pre>\n
**<\/span><\/pre>\n
*\/<\/span><\/pre>\n
NTSTATUS DriverEntry(PDRIVER_OBJECT\u00a0\u00a0\u00a0\u00a0 pDriverObj,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 PUNICODE_STRING\u00a0\u00a0\u00a0 pusRegistryPath)<\/pre>\n
{<\/pre>\n
\u00a0\u00a0\u00a0 NTSTATUS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 nts;<\/pre>\n
\u00a0\u00a0\u00a0 PVOID\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pBaseAddress, pTemp;<\/pre>\n
\u00a0\u00a0\u00a0 PF_EX_FREE_POOL_WITH_TAG\u00a0\u00a0\u00a0 pfExFreePoolWithTag;<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Set the unload callback routine<\/span><\/pre>\n
\u00a0\u00a0\u00a0 pDriverObj->DriverUnload = OnDriverUnload;<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Get the module base address<\/span><\/pre>\n
\u00a0\u00a0\u00a0 nts = RtlGetModuleBase(\"ntoskrnl.exe\"<\/span>,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0 &pBaseAddress);<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Testing the routine's return doesn't hurt,<\/span><\/pre>\n
\u00a0\u00a0\u00a0 \/\/\u00a0\u00a0\u00a0\u00a0\u00a0 but not doing this can kill your system.<\/span><\/pre>\n
\u00a0\u00a0\u00a0 if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 return<\/span> nts;<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Allocating memory for a test using the Free routine<\/span><\/pre>\n
\u00a0\u00a0\u00a0 pTemp = ExAllocatePoolWithTag(NonPagedPool,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 10<\/span>,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 'tseT'<\/span>);<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Get the function API address<\/span><\/pre>\n
\u00a0\u00a0\u00a0 nts = RtlGetProcAddress(pBaseAddress,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \"ExFreePoolWithTag\"<\/span>,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 (NTPROC*)&pfExFreePoolWithTag);<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 if<\/span> (NT_SUCCESS(nts))<\/pre>\n
\u00a0\u00a0\u00a0 {<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/-f--> If that routine is implemented by the system, so<\/span><\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/\u00a0\u00a0\u00a0\u00a0\u00a0 we get a success return code here.<\/span><\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pfExFreePoolWithTag(pTemp,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 'tseT'<\/span>);<\/pre>\n
\u00a0\u00a0\u00a0 }<\/pre>\n
\u00a0\u00a0\u00a0 else<\/span><\/pre>\n
\u00a0\u00a0\u00a0 {<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/-f--> Who has no dog, hunts like a cat.<\/span><\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ExFreePool(pTemp);<\/pre>\n
\u00a0\u00a0\u00a0 }<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 return<\/span> STATUS_SUCCESS;<\/pre>\n
}<\/pre>\n<\/div>\n
Have fun! \ud83d\ude42<\/p>\n
ExGetProc.zip<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
In the post ExAllocatePool (WithoutTag), I talked a little about the conflicts on using new APIs in drivers and making them incompatible with legacy systems.\u00a0Our initial proposal was to have a single binary that would be able to run either in Windows NT and newer systems.\u00a0We reached a solution that cannot be considered ideal, that […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-35","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/35","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/comments?post=35"}],"version-history":[{"count":2,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/35\/revisions"}],"predecessor-version":[{"id":42,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/35\/revisions\/42"}],"wp:attachment":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/media?parent=35"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/categories?post=35"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/tags?post=35"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}