MemoryBasicVlmInformation (Extract SizeOfImage From Kernel)

//http://waleedassar.blogspot.com - (@waleedassar)
//This code shows how to extract the "SizeOfImage" value of a process directly from the kernel.
//The "SizeOfImage" value has always been used by anti-dumping trick to defeat dumping tools.
//Useful if you are trying to design your dumping tool.
#include "stdafx.h"
#include "windows.h"

#pragma data_seg("walied4")
int x=1;
#pragma data_seg()

#define MemoryBasicVlmInformation 0x3

struct MEMORY_BASIC_VLM_INFORMATION
{
    unsigned long ImageBase;
    unsigned long blah[0x2];
    unsigned long SizeOfImage;
};

extern "C"
{
    int __stdcall ZwQueryVirtualMemory(HANDLE,void*,int,void*,int,unsigned long*);
}

int main(int argc, char* argv[])
{
    unsigned long out=0;
    MEMORY_BASIC_VLM_INFORMATION MBVI={0};
    ZwQueryVirtualMemory(GetCurrentProcess(),&x /*anywhere withing the PE range*/,MemoryBasicVlmInformation,&MBVI,sizeof(MBVI),&out);
    unsigned long szImage=MBVI.SizeOfImage;
    return 0;
}