Ntdll/RtlGetNativeSystemInformation

[JMC31337]

messing around with some code done by H0mbre at https://h0mbre.github.io/HEVD_Stackoverflow_SMEP_Bypass_64bit/

thought i'd put this on the tuts4you walls to obtain ntoskrnl location using undocumented RtlGetNativeSystemInformation

#include <windows.h>
#include <iostream>
using namespace std;

FARPROC proc; HMODULE hdll; LONG* ntos;

WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{

hdll = LoadLibrary("ntdll");
proc = GetProcAddress(hdll,"RtlGetNativeSystemInformation");

VirtualAlloc(NULL,0x1000,0x3000,0x40);

asm
(
"mov rcx,0x0b\r\n"
"mov rdx,rax\r\n"
"mov r8,0x1000\r\n"
"mov r9,rbp\r\n"
);
proc();

asm
(
"mov rax,[rsp]\r\n"
"mov rax,[rax+0x18]\r\n"
"mov ntos,rax\r\n"
);

cout<<ntos<<endl;
getchar();
  
}