BOOL
CALLBACK SymEnumShadowSSDT(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext)
{
PDWORD pAddr
=
pSymInfo
-
>Address;
if
(
*
pAddr
=
=
0xB8D18B4C
)
{
printf(
"%x,%s\n"
,
*
(pAddr
+
1
), pSymInfo
-
>Name);
}
return
TRUE;
}
BOOL
CALLBACK SymEnumSSDT(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext)
{
PDWORD pAddr
=
pSymInfo
-
>Address;
if
(
*
pAddr
=
=
0xB8D18B4C
)
{
if
(!strncmp(pSymInfo
-
>Name,
"Nt"
,
2
))
printf(
"%x,%s\n"
,
*
(pAddr
+
1
), pSymInfo
-
>Name);
}
return
TRUE;
}
GetSym(char
*
exe, PSYM_ENUMERATESYMBOLS_CALLBACK EnumFunc)
{
SYMBOL_INFO sym
=
{
0
};
DWORD64 sModule;
PLOADED_IMAGE pImage
=
{
0
};
HANDLE hProc
=
GetCurrentProcess();
SymInitialize(hProc, NULL, TRUE);
pImage
=
ImageLoad(exe, NULL);
sModule
=
SymLoadModuleEx(hProc, pImage
-
>hFile, exe, pImage
-
>ModuleName, pImage
-
>MappedAddress, pImage
-
>SizeOfImage,
0
,
0
);
SymEnumSymbols(hProc, pImage
-
>MappedAddress, NULL, EnumFunc, NULL);
}
int
main(
int
argc, char
*
argv[])
{
/
/
GetSym(
"win32u.dll"
,SymEnumShadowSSDT);
GetSym(
"ntdll.dll"
, SymEnumSSDT);
system(
"pause"
);
return
0
;
}