Skip to content

Instantly share code, notes, and snippets.

@nmulasmajic

nmulasmajic/Script output - IDAPython output.txt Secret

Created July 10, 2017 03:43
Show Gist options
  • Save nmulasmajic/e217cddda28b6da4cff78a64d65565de to your computer and use it in GitHub Desktop.
Save nmulasmajic/e217cddda28b6da4cff78a64d65565de to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Script output - IDAPython output.txt
====================================================================================================
Discovers the base address of ntoskrnl when IDA's GDB stub is loaded by leveraging the IDT.
NOTE: This is only compatible for 64-bit editions of Windows.
~ http://triplefault.io ~
====================================================================================================
IDT base @ 0xfffff802c4850000L.
_KIDTENTRY64[0] (nt!KiDivideErrorFault) @ 0xfffff802c27f4300L.
Searching for base address of symbol @ 0xfffff802c27f4300L (0xfffff802c27f4000L).
====================================================================================================
0xfffff802c27f4000L --> 0xffff
0xfffff802c27f3000L --> 0x4817
0xfffff802c27f2000L --> 0x48ff
...
0xfffff802c2684000L --> 0xe850
0xfffff802c2683000L --> 0x3
0xfffff802c2682000L --> 0x7f4d
0xfffff802c2681000L --> 0x0
0xfffff802c2680000L --> 0x5a4d
0xfffff802c2680108L --> 0x4550
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Base address located @ 0xfffff802c2680000L.
The base address of nt (ntoskrnl) is @ 0xfffff802c2680000L.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment