Traverse loaded driver Sys_ Demon Domain Drive _ Phantom

ULONG getsysimagebase (Pchar pszsysname) {ULONG uimagebase = 0;
	ULONG usize = 0x10000;
	PVOID Pmoduleinfo = ExAllocatePool (NonPagedPool, usize);
	if (pmoduleinfo==null) {return uimagebase;
	NTSTATUS status = Zwquerysysteminformation (Systemmoduleinformation, Pmoduleinfo, usize, NULL); if (!
		Nt_success (status)) {Exfreepool (pmoduleinfo);
		return uimagebase;
	} ULONG unumberofmodules = * (Pulong) Pmoduleinfo;
	if (unumberofmodules==0) {return uimagebase;

	} prtl_process_module_information Pstart = (prtl_process_module_information) ((ULONG) Pmoduleinfo + sizeof (ULONG));
		for (ULONG i = 0; i < unumberofmodules;i++) {Puchar pszfullname = pstart->fullpathname;
		ULONG Uoffsetname = pstart->offsettofilename;
		Puchar pszname = Pszfullname + uoffsetname;
			if (_stricmp (const char*) pszname,pszsysname) ==0) {uimagebase = (ULONG) pstart->imagebase;
	
			Break
		return uimagebase;
	} pstart++;
	} if (Pmoduleinfo!=null) {exfreepool (pmoduleinfo);
	}return uimagebase; }

#include "ntifs.h" #include "intsafe.h" #include "ntimage.h" typedef struct _RTL_PROCESS_MODULE_INFORMATION {HANDLE
	Section;
	PVOID Mappedbase;
	PVOID ImageBase;
	ULONG ImageSize;
	ULONG Flags;
	USHORT Loadorderindex;
	USHORT Initorderindex;
	USHORT Loadcount;
	USHORT Offsettofilename;
Uchar fullpathname[256];

} rtl_process_module_information, *prtl_process_module_information;
	typedef struct _SYSTEM_MODULE_INFORMATION//system module Information {ULONG reserved[2];
	ULONG Base;
	ULONG Size;
	ULONG Flags;
	USHORT Index;
	USHORT Unknown;
	USHORT Loadcount;
	USHORT Modulenameoffset;
CHAR imagename[256];
} system_module_information, *psystem_module_information;
	typedef struct _TAGSYSMODULELIST//module chain structure {ULONG ulcount;
System_module_information Smi[1];
} MODULES, *pmodules;
ULONG getsysimagebase (Pchar pszsysname); NTSTATUS __stdcall zwquerysysteminformation (ulong_ptr systeminformationclass, pvoid systeminformation, ULONG
Systeminformationlength, Pulong returnlength); #define Systemmoduleinformation 11