General Techniques

This chapter will outline some of the techniques and algorithms that are generally applicable to most kernel-mode payloads. For example, kernel-mode payloads may find it necessary to resolve certain exported symbols for use within the payload itself, much the same as user-mode payloads find it necessary.

• Finding Ntoskrnl.exe Base Address
  • IDT Scandown
  • KPRCB IdleThread Scandown
  • SYSENTER_EIP_MSR Scandown
  • Known Portable Base Scandown
  
  
• Resolving Symbols