[madaboo]

Hi,

Assuming that SDT has been hooked e.g for ZwClose.
Is it possible from kernelland to locate original NtClose syscall?
I understand that MmGetSystemRoutineAddress () is not enough here since not all Nt* api calls are exported - is it right?
Thank you

[rkhunter]

Search for original SSDT, http://www.kernelmode.info/forum/viewto ... 1145#p8637.