text: // NtQuerySysInfo_SystemModuleInformation.cpp : Attempts to use the NtQuerySystemInformation to find the base addresses if loaded modules.
  //
  
  #include "stdafx.h"
  #include <windows.h>
  
  #define MAXIMUM_FILENAME_LENGTH 255 
  
  typedef struct _SYSTEM_HANDLE
  {
  	PVOID Object;
  	HANDLE UniqueProcessId;
  	HANDLE HandleValue;
  	ULONG GrantedAccess;
  	USHORT CreatorBackTraceIndex;
  	USHORT ObjectTypeIndex;
  	ULONG HandleAttributes;
  	ULONG Reserved;
  } SYSTEM_HANDLE, *PSYSTEM_HANDLE;
  
  typedef struct _SYSTEM_HANDLE_INFORMATION_EX
  {
  	ULONG_PTR HandleCount;
  	ULONG_PTR Reserved;
  	SYSTEM_HANDLE Handles[1];
  } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
  
  typedef enum _SYSTEM_INFORMATION_CLASS {
  	SystemExtendedHandleInformation = 64
  } SYSTEM_INFORMATION_CLASS;
  
  typedef NTSTATUS(WINAPI *PNtQuerySystemInformation)(
  	__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
  	__inout PVOID SystemInformation,
  	__in ULONG SystemInformationLength,
  	__out_opt PULONG ReturnLength
  	);
  
  int main()
  {
  	HMODULE ntdll = GetModuleHandle(TEXT("ntdll"));
  	PNtQuerySystemInformation query = (PNtQuerySystemInformation)GetProcAddress(ntdll, "NtQuerySystemInformation");
  	if (query == NULL) {
  		printf("GetProcAddress() failed.\n");
  		return 1;
  	}
  	ULONG len = 20;
  	NTSTATUS status = (NTSTATUS)0xc0000004;
  	PSYSTEM_HANDLE_INFORMATION_EX pHandleInfo = NULL;
  	do {
  		len *= 2;
  		pHandleInfo = (PSYSTEM_HANDLE_INFORMATION_EX)GlobalAlloc(GMEM_ZEROINIT, len);
  
  		status = query(SystemExtendedHandleInformation, pHandleInfo, len, &len);
  
  	} while (status == (NTSTATUS) 0xc0000004);
  	if (status != (NTSTATUS)0x0) {
  		printf("NtQuerySystemInformation failed with error code 0x%X\n", status);
  		return 1;
  	}
  	for (int i = 0; i < pHandleInfo->HandleCount; i++) {
  		PVOID object = pHandleInfo->Handles[i].Object;
  		HANDLE handle = pHandleInfo->Handles[i].HandleValue;
  		HANDLE pid = pHandleInfo->Handles[i].UniqueProcessId;
  		printf("PID: %d\t", pid);
  #ifdef _WIN64
  		printf("Object 0x%llx\t", object);
  #else
  		printf("Object 0x%X\t", object);
  #endif
  		printf("Handle 0x%x\r\n", handle);
  	}
  	return 0;
  }
  
  