Resolving System Service Numbers using the Exception Directory
Apr 19th, 2022
Written by: Admin
ActiveBreach
Introduction While developing new features for Nighthawk C2, we observed that NTDLL contains up to three internal tables with the Relative Virtual Address (RVA) of all system calls. Two of these…