From 8897981acfbbdf60b43c39ad8c7ea3896b4e44be Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Mon, 8 Mar 2021 19:44:49 +0000 Subject: [PATCH] Update README.md --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index 2e11d3b..b581363 100644 --- a/README.md +++ b/README.md @@ -521,6 +521,24 @@ Mind the space at the beginning of each line. If you want to generate a file lik .... ``` +Once you have generated a map file for ntoskrnl.exe, or any other binary you want to link with, you can then use it to resolve external symbols. In the `DemoDrv` project, I reference two external symbols. One being `PiddbCacheTable`, and the other being a win32kfull.sys export. + +```cpp +// this is a demo of resolving non-exported symbols... +// win32kfull.sys export example... +extern "C" void NtUserRegisterShellPTPListener(); +extern "C" void* PiDDBCacheTable; + +``` + +These two symbols are simply printed out via DbgPrint. + +```cpp +// non-exported symbols being resolved by jit linker... +DbgPrint("> PiDDBCacheTable = 0x%p\n", &PiDDBCacheTable); +DbgPrint("> win32kfull!NtUserRegisterShellPTPListener = 0x%p\n", &NtUserRegisterShellPTPListener); +`` + ### Usermode Example # License - BSD 3-Clause