Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Find address of win32kbase!NtGdiDdDDISubmitCommand #2

Closed
r1cky33 opened this issue Oct 23, 2019 · 5 comments
Closed

Find address of win32kbase!NtGdiDdDDISubmitCommand #2

r1cky33 opened this issue Oct 23, 2019 · 5 comments

Comments

@r1cky33
Copy link

r1cky33 commented Oct 23, 2019

Yo,

i just was wondering, on how i should obtain the address of win32kbase!NtGdiDdDDISubmitCommand. I tried with RtlFindExportedRoutineByName(), but that didnt work^^ So do i have to reverse it myself? (find the entry from some exported table in win32kbase). sry if im stupid, but im really no specialist at this.

greeds!

@ghost
Copy link

ghost commented Oct 24, 2019

You could do something like this: https://gist.github.com/alxbrn/90abf9ad3a44d1d357644a520b0719a5

@r1cky33
Copy link
Author

r1cky33 commented Oct 24, 2019

i tried that, but no result: https://gyazo.com/ccd7c7d59fa190f27accc959d2e191ce

@r1cky33
Copy link
Author

r1cky33 commented Oct 24, 2019

in IDA the export is there.

@r1cky33
Copy link
Author

r1cky33 commented Oct 24, 2019

Sry, for spamming this issue, but I just fixed my problem. I adapted the GetKernelModuleExport func from kdmapper (1803-1903) by @AlxBrn to use in my driver. https://github.com/alxbrn/kdmapper-1803-1903/blob/master/kdmapper/intel_driver.cpp#L208

Works like a charm: https://gyazo.com/dfd0e7cda71cd14b1beb0273ff5fde21

@r1cky33 r1cky33 closed this as completed Oct 25, 2019
@ironxu
Copy link

ironxu commented Nov 16, 2019

抱歉,为该问题发送了垃圾邮件,但我只是解决了问题。我将@AlxBrn的kdmapper(1803-1903)中的GetKernelModuleExport函数修改为可在驱动程序中使用。https://github.com/alxbrn/kdmapper-1803-1903/blob/master/kdmapper/intel_driver.cpp#L208

像魅力一样工作:https : //gyazo.com/dfd0e7cda71cd14b1beb0273ff5fde21

Can you provide a project file?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants