confirmed
issue: 12145
you can use workaraund:
getOffset("nt!PsLoadedModuleList") - work properly
nt = module("nt")
nt.PsLoadedModuleList - work properly
issue: 12145
you can use workaraund:
getOffset("nt!PsLoadedModuleList") - work properly
nt = module("nt")
nt.PsLoadedModuleList - work properly