How to locate address of a function using base address of the executable?

Question

OK so I have the base address of ntoskrnl.exe and want to locate the address of an internal function that is neither exported or imported. How can this be done in kernel mode ?

Answer 1

You can pattern scan for the function, or it has a static RVA. There are many ways, but the easiest is by creating a signature (for example with SigMaker in IDA Pro) and scanning for it inside your module.

For exported routines this is much easier:

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmgetsystemroutineaddress

For within a specific module, you can manually walk the EAT (Export Address Table).