---

"""
Получает ntoskrnl base address для вычисления CR3.
Запускать от администратора на ИГРОВОМ ПК.
"""
import subprocess, sys

r = subprocess.run(['powershell', '-Command', '''
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class NtDll {
    [DllImport("ntdll.dll")]
    public static extern int NtQuerySystemInformation(int cls, IntPtr buf, int len, ref int rlen);
}
"@
$buf = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(0x200000)
$rlen = 0
$status = [NtDll]::NtQuerySystemInformation(11, $buf, 0x200000, [ref]$rlen)
if ($status -eq 0) {
    $count = [System.Runtime.InteropServices.Marshal]::ReadInt32($buf, 0)
    Write-Host "MODULE COUNT: $count"
    $off = 4
    for ($i = 0; $i -lt [Math]::Min($count,5); $i++) {
        $base = [System.Runtime.InteropServices.Marshal]::ReadInt64($buf, $off + 0x10)
        $nameBytes = New-Object byte[] 256
        for ($j = 0; $j -lt 256; $j++) {
            $nameBytes[$j] = [System.Runtime.InteropServices.Marshal]::ReadByte($buf, $off + 0x28 + $j)
            if ($nameBytes[$j] -eq 0) { break }
        }
        $name = [System.Text.Encoding]::ASCII.GetString($nameBytes).TrimEnd([char]0)
        Write-Host "MODULE[$i]: base=0x$($base.ToString('X16')) name=$name"
        $off += 0x128
    }
} else {
    Write-Host "STATUS: 0x$($status.ToString('X8'))"
}
[System.Runtime.InteropServices.Marshal]::FreeHGlobal($buf)
'''], capture_output=True, text=True, timeout=30)

print(r.stdout)
if r.stderr:
    print("ERR:", r.stderr[:300])