https://github.com/kkent030315/ntsymbol
Resolve DOS MZ executable symbols at runtime
https://github.com/kkent030315/ntsymbol
kernel ntsymbol rootkit rootkits symbol symbols windows
Last synced: 7 months ago
JSON representation
Resolve DOS MZ executable symbols at runtime
- Host: GitHub
- URL: https://github.com/kkent030315/ntsymbol
- Owner: kkent030315
- License: mit
- Created: 2021-11-11T06:12:39.000Z (almost 4 years ago)
- Default Branch: main
- Last Pushed: 2021-11-12T04:07:12.000Z (almost 4 years ago)
- Last Synced: 2025-03-09T05:43:09.479Z (7 months ago)
- Topics: kernel, ntsymbol, rootkit, rootkits, symbol, symbols, windows
- Language: C++
- Homepage:
- Size: 32.2 KB
- Stars: 96
- Watchers: 5
- Forks: 25
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
![]()
![]()
![]()
# NtSymbol
Resolve DOS MZ executable symbols at runtime
# Example
You no longer have not have to use memory pattern scan inside your sneaky rootkit. Pass the RVAs into your kernel payloads!
```cpp
int main()
{
ntsymbol ntoskrnl("%SYSTEMROOT%\\system32\\ntoskrnl.exe");
ntoskrnl.init();
/* Useful for retriving NTOS image base without any calls */
const auto RvaPsNtosImageBase = ntoskrnl.resolve(L"PsNtosImageBase");
ntsymbol cidll("%SYSTEMROOT%\\system32\\CI.dll");
cidll.init();
/* DSE Bypass! */
const auto RvaCiOptions = cidll.resolve(L"g_CiOptions");
}
```