Search code examples
windows-7kernelwindbgsql-server-data-tools

How to get address of Shadow SSDT?

I want to get the address of SSDT and Shadow SSDT using windbg.Windbg successfully connected to vmware .which commmand i have to use to get the address of these tables?

Solution

  • The x command displays the symbols in all contexts that match the specified pattern x [Options] Module!Symbol.

    lkd> x nt!*keservicedescriptortable*
82da2980 nt!KeServiceDescriptorTableShadow = <no type information>
82da2940 nt!KeServiceDescriptorTable = <no type information>

lkd> dps 82da2980 
82da2980  82c9f634 nt!KiServiceTable
82da2984  00000000
82da2988  00000191
82da298c  82c9fc7c nt!KiArgumentTable
82da2990  95b66000 win32k!W32pServiceTable
82da2994  00000000
82da2998  00000339
82da299c  95b6702c win32k!W32pArgumentTable