DynamicKernelShellcode

An example of how x64 kernel shellcode can dynamically find and use kernel APIs (exported from ntoskrnl).
Tested on Windows 10 x64 (1903)
The shellcode is capable of returning function addresses from ntoskrnl. For more practical use, it can easily be modified to call these functions. I used FASM as the assembler, but there is no special syntax so others should work. The Python file included is capable of generating the hashes needed.

Useful resources

• DoublePulsar Shellcode Information
• Super useful information about IDT
• PE Format Image
• Great In Depth Information on PE Format
• djb2 algorithm