Advertisement
es3n1n

get ntoskrnl base address

Mar 7th, 2022 (edited)
508
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.13 KB | None | 0 0
  1.         inline uintptr_t get_kernel_base( ) { // @credits: https://www.unknowncheats.me/forum/3238153-post14.html
  2.             uintptr_t idt_base = *reinterpret_cast< uintptr_t* >( __readgsqword( 0x18 ) + 0x38 );
  3.             uintptr_t base_addr = *reinterpret_cast< uintptr_t* >( reinterpret_cast< uint8_t* >( idt_base ) + 4 ) & 0xFFFFFFFFFFFFF000;
  4.  
  5.         start:
  6.             uintptr_t index = 0;
  7.  
  8.             while ( true ) {
  9.                 if ( *reinterpret_cast< uint8_t* >( base_addr + index ) == 0x48 &&
  10.                      *reinterpret_cast< uint8_t* >( base_addr + index + 1 ) == 0x8D &&
  11.                      *reinterpret_cast< uint8_t* >( base_addr + index + 2 ) == 0x1D &&
  12.                      *reinterpret_cast< uint8_t* >( base_addr + index + 6 ) == 0xFF ) { // 48 8D 1D ?? ?? ?? FF
  13.  
  14.                     uint32_t offset = *reinterpret_cast< uint32_t* >( base_addr + index + 3 );
  15.  
  16.                     if ( ( ( static_cast< uint16_t >( base_addr ) + static_cast< uint16_t >( index ) + static_cast< uint16_t >( offset ) + 7 ) & 0xFFF ) == 0 )
  17.                         return base_addr & 0xFFFFFFFF00000000 | static_cast< unsigned int >( index + base_addr + offset + 7 );
  18.                 }
  19.  
  20.                 if ( ++index == 4089 ) {
  21.                     base_addr -= 0x1000;
  22.                     goto start;
  23.                 }
  24.             }
  25.  
  26.             return 0x0;
  27.         }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement