An open API service indexing awesome lists of open source software.

https://github.com/kkent030315/ntsymbol

Resolve DOS MZ executable symbols at runtime
https://github.com/kkent030315/ntsymbol

kernel ntsymbol rootkit rootkits symbol symbols windows

Last synced: 7 months ago
JSON representation

Resolve DOS MZ executable symbols at runtime

Awesome Lists containing this project

README

          






# NtSymbol

Resolve DOS MZ executable symbols at runtime

# Example

You no longer have not have to use memory pattern scan inside your sneaky rootkit. Pass the RVAs into your kernel payloads!

```cpp
int main()
{
ntsymbol ntoskrnl("%SYSTEMROOT%\\system32\\ntoskrnl.exe");
ntoskrnl.init();
/* Useful for retriving NTOS image base without any calls */
const auto RvaPsNtosImageBase = ntoskrnl.resolve(L"PsNtosImageBase");


ntsymbol cidll("%SYSTEMROOT%\\system32\\CI.dll");
cidll.init();
/* DSE Bypass! */
const auto RvaCiOptions = cidll.resolve(L"g_CiOptions");
}
```