From 718aaf33a3be01b1b50b7a3f2759b9c19570ae13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Benjamin=20H=C3=B6glinger-Stelzer?= Date: Sun, 18 Jun 2023 18:34:23 +0200 Subject: [PATCH] Added warning text --- Snippets/WDM/GetProcAddress.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Snippets/WDM/GetProcAddress.md b/Snippets/WDM/GetProcAddress.md index 895d7a8..a596f8c 100644 --- a/Snippets/WDM/GetProcAddress.md +++ b/Snippets/WDM/GetProcAddress.md @@ -2,6 +2,8 @@ For dynamically calling functions, [`MmGetSystemRoutineAddress`](https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmgetsystemroutineaddress) will only work for exports from `NtosKrnl.exe`, but what if you wish to get a pointer to a function of an export driver (a.k.a. kernel DLL)? The following snippet has been tested on Windows 10 version 1507 and upwards. +**WARNING:** in contrast to `LoadLibrary`s behaviour calling `FindDriverBaseAddress` will **not** load the desired module, if not found! I might add another helper function to achieve this in the future, if need arises. + ## Header ```c