OBJECT_ATTRIBUTES ObjectAttributes;
RtlInitUnicodeString(&FileName, L"\\SystemRoot\\system32\\ntdll.dll");
InitializeObjectAttributes(&ObjectAttributes, &FileName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
if(KeGetCurrentIrql() != PASSIVE_LEVEL)
return STATUS_UNSUCCESSFUL;
IO_STATUS_BLOCK IoStatusBlock;
NTSTATUS NtStatus = ZwCreateFile(&FileHandle,
FILE_SYNCHRONOUS_IO_NONALERT,
// Get ntdll.dll file size
FILE_STANDARD_INFORMATION StandardInformation = { 0 };
NtStatus = ZwQueryInformationFile(FileHandle, &IoStatusBlock, &StandardInformation, sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation);
FileSize = StandardInformation.EndOfFile.LowPart;
FileData = (unsigned char*)RtlAllocateMemory(true, FileSize);
LARGE_INTEGER ByteOffset;
ByteOffset.LowPart = ByteOffset.HighPart = 0;
// Read ntdll.dll into buffer
NtStatus = ZwReadFile(FileHandle,