Quote:
|
Originally Posted by MarkusO
Just to name one, how do you plan to call LoadLibrary or GetProcAddres from Ring-0? KERNEL32 is not present and you can't use SEH to find the imports by trial and error.  |
Simple, find ptr to ntoskrnl.exe from IDT and then cycle backward till you find ntoskrnl.exe base
then locate ZwQuerySystemInformation to receive addresses of needed drivers and write GetProcAddress by yourself walking trough exports of needed .sys files
At least that's how I would do it.