DynamicKernelShellcode

An example of how x64 kernel shellcode can dynamically find and use kernel APIs (exported from ntoskrnl). <br> Tested on Windows 10 x64 (1903)
The shellcode is capable of returning function addresses from ntoskrnl. For more practical use, it can easily be modified to call these functions. I used FASM as the assembler, but there is no special syntax so others should work. The Python file included is capable of generating the hashes needed.

Useful resources

• DoublePulsar Shellcode Information
• Super useful information about IDT
• PE Format Image
• Great In Depth Information on PE Format
• djb2 algorithm