CiOptions: Simplifies the way CI.dll base address is recovered

Instead of using the kernel R/W primitive, uses userland API to enumerate
kernel modules

EDRSandblast/Includes/KernelDSE.h

@@ -2,10 +2,12 @@
 #pragma comment(lib, "ntdll.lib")
 #define DEFAULT_EVIL_DRIVER_FILE TEXT("evil.sys")
 
+#include "PrintFunctions.h"
+
 #if !defined(PRINT_ERROR_AUTO)
 #define PRINT_ERROR_AUTO(func) _tprintf_or_not(TEXT("[!] ERROR ") TEXT(__FUNCTION__) TEXT(" ; ") func TEXT(" (0x%08x)\n"), GetLastError())
 #endif
 
 BOOLEAN IsCiEnabled();
-DWORD64  FindCIBaseAddress(BOOL verbose);
+DWORD64  FindCIBaseAddress();
 BOOL patch_gCiOptions(DWORD64 CiVariableAddress, ULONG CiOptionsValue, PULONG OldCiOptionsValue);

EDRSandblast/Includes/KernelUtils.h

@@ -2,6 +2,7 @@
 #include <Windows.h>
 
 DWORD64 FindNtoskrnlBaseAddress(void);
+DWORD64 FindKernelModuleAddressByName(_In_ LPTSTR name);
 TCHAR* FindDriverName(DWORD64 address, _Out_opt_ PDWORD64 offset);
 TCHAR* FindDriverPath(DWORD64 address);
 DWORD64 GetKernelFunctionAddress(LPCSTR function);

EDRSandblast/Includes/PrintFunctions.h

@@ -1,5 +1,8 @@
 #pragma once
 
+#include <stdio.h>
+#include <tchar.h>
+
 #define NO_STRINGS 0
 
 #if NO_STRINGS