-
Notifications
You must be signed in to change notification settings - Fork 0
Syscall dumper using LDR_DATA_TABLE_ENTRY structure and gs:segment offset to find base address of ntdll.dll. Then the IMAGE_EXPORT_DIRECTORY is parsed for its pEAT to match with syscall signature { 0x4c,0x8b,0xd1,0xb8 }. The matching addresses are printed on console
Axactt/SysCall_Dumper
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
About
Syscall dumper using LDR_DATA_TABLE_ENTRY structure and gs:segment offset to find base address of ntdll.dll. Then the IMAGE_EXPORT_DIRECTORY is parsed for its pEAT to match with syscall signature { 0x4c,0x8b,0xd1,0xb8 }. The matching addresses are printed on console
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published