From 6c3862d1e2d08c9a82623e0d4ab3bb123a3efde0 Mon Sep 17 00:00:00 2001
From: Zebediah Figura <z.figura12@gmail.com>
Date: Fri, 12 Apr 2019 20:06:08 -0500
Subject: [PATCH] ntdll: Add stub for
 NtQuerySystemInformation(SystemModuleInformationEx).

Based on a patch by Andrew Wesie.
---
 dlls/ntdll/unix/system.c | 41 ++++++++++++++++++++++++++++++++++++++++
 include/winternl.h       |  9 +++++++++
 2 files changed, 50 insertions(+)

diff --git a/dlls/ntdll/unix/system.c b/dlls/ntdll/unix/system.c
index c3dca7ffe28..1260326bc4b 100644
--- a/dlls/ntdll/unix/system.c
+++ b/dlls/ntdll/unix/system.c
@@ -2328,6 +2328,47 @@ NTSTATUS WINAPI NtQuerySystemInformation( SYSTEM_INFORMATION_CLASS class,
         break;
     }
 
+    case SystemModuleInformationEx:
+    {
+        /* FIXME: return some fake info for now */
+        static const char *fake_modules[] =
+        {
+            "\\SystemRoot\\system32\\ntoskrnl.exe",
+            "\\SystemRoot\\system32\\hal.dll",
+            "\\SystemRoot\\system32\\drivers\\mountmgr.sys"
+        };
+
+        if (!info) ret = STATUS_ACCESS_VIOLATION;
+        else
+        {
+            ULONG i;
+
+            for (i = 0; i < ARRAY_SIZE(fake_modules); i++)
+            {
+                SYSTEM_MODULE_INFORMATION_EX *smi = (SYSTEM_MODULE_INFORMATION_EX *)((char *)info + len);
+
+                len += sizeof(SYSTEM_MODULE_INFORMATION_EX);
+                if (len > size)
+                {
+                    ret = STATUS_INFO_LENGTH_MISMATCH;
+                    continue;
+                }
+
+                memset(smi, 0, sizeof(*smi));
+                if (i < ARRAY_SIZE(fake_modules) - 1)
+                    smi->NextOffset = len;
+                smi->BaseInfo.ImageBaseAddress = (char *)0x10000000 + 0x200000 * i;
+                smi->BaseInfo.ImageSize = 0x200000;
+                smi->BaseInfo.LoadOrderIndex = i;
+                smi->BaseInfo.LoadCount = 1;
+                strcpy( (char *)smi->BaseInfo.Name, fake_modules[i] );
+                smi->BaseInfo.NameOffset = strrchr( fake_modules[i], '\\' ) - fake_modules[i] + 1;
+                smi->DefaultBase = smi->BaseInfo.ImageBaseAddress;
+            }
+        }
+        break;
+    }
+
     case SystemHandleInformation:
     {
         struct handle_info *handle_info;
diff --git a/include/winternl.h b/include/winternl.h
index 10d109fede1..b91af1d2dbe 100644
--- a/include/winternl.h
+++ b/include/winternl.h
@@ -2484,6 +2484,15 @@ typedef struct _SYSTEM_MODULE_INFORMATION
 #define PROCESS_CREATE_FLAGS_SUSPENDED              0x00000200
 #define PROCESS_CREATE_FLAGS_EXTENDED_UNKNOWN       0x00000400
 
+typedef struct _SYSTEM_MODULE_INFORMATION_EX
+{
+    ULONG NextOffset;
+    SYSTEM_MODULE BaseInfo;
+    ULONG ImageCheckSum;
+    ULONG TimeDateStamp;
+    void *DefaultBase;
+} SYSTEM_MODULE_INFORMATION_EX, *PSYSTEM_MODULE_INFORMATION_EX;
+
 #define THREAD_CREATE_FLAGS_CREATE_SUSPENDED        0x00000001
 #define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH      0x00000002
 #define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER      0x00000004
-- 
2.27.0

