Cheat Engine

[azfk]

How do you find the base of the loaded kernel and its size?

Also, when you copy it and get an address to the function, is the address relative or absolute? Do you add it to the base or subtract?

[Guy]

GetModuleHandle("ntoskrnl.exe");


Haha, just kidding.

Here's a quick link I found on locating it in kernel land, which uses four varying techniques to do so, good luck! http://uninformed.org/index.cgi?v=3&a=4&p=5

[igoticecream]

[Dark Byte]

the driver can also be loaded at 80400000

anyhow, you can use psapi's EnumDeviceDrivers api combined with GetDeviceDriverBaseNameA to get the name of the drivers

ntoskrnl**.exe is the name of the driver you need