KernelGetModuleBaseByPtr is rewritten using RtlPcToFileHeader.

[scudette]

This should fix a crash on recent windows versions.

[scudette]

Test signed driver
drivers.zip

[eltms]

Hello Mike,
I tested the recent drivers downloaded from: https://github.com/google/rekall/files/5178296/drivers.zip

When I ran this command on cmd:
winpmem.py -d bin\winpmem.sys -f foobar.raw

I get this output:
(577, 'StartService', 'Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.'): will try to continue
Traceback (most recent call last):
File "...\winpmem\rekall-KernelGetModuleBaseByPtr\tools\windows\winpmem\winpmem.py", line 258, in
main()
File "...\winpmem\rekall-KernelGetModuleBaseByPtr\tools\windows\winpmem\winpmem.py", line 238, in main
None)
pywintypes.error: (2, 'CreateFile', 'The system cannot find the file specified.')

Any help or suggestion please?
Elty