Skip to content

Instantly share code, notes, and snippets.

@v1stra
Created June 27, 2024 17:27
Show Gist options
  • Select an option

  • Save v1stra/f0555852487570801f6ba9675d2f198d to your computer and use it in GitHub Desktop.

Select an option

Save v1stra/f0555852487570801f6ba9675d2f198d to your computer and use it in GitHub Desktop.
asm_get_ntdll.c
/* tcc asm_get_ntdll.c */
#include <Windows.h>
#include <stdio.h>
void * get_ntdll() {
unsigned long long ret;
__asm__ (
"
xorq %%rax, %%rax
xorq %%rbx, %%rbx
mov $0x60, %%rbx
mov %%gs:(%%rbx), %%rax
mov 0x18(%%rax), %%rax
mov 0x20(%%rax), %%rax
mov (%%rax), %%rax
movq 0x20(%%rax), %%rax
"
: "=a" (ret) /* outputs */
: /* no inputs */
: "rbx", "memory"); /* clobbers */
return((void *)ret);
}
int main() {
printf("get_ntdll->0x%p\n", get_ntdll());
printf("GeModuleHandle->0x%p\n", GetModuleHandle("ntdll"));
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment