Re: Re: Address of loading ntoskrnl.exe [rus]

Home Forums Discussions General Address of loading ntoskrnl.exe [rus] Re: Re: Address of loading ntoskrnl.exe [rus]

#6271
dkg0414
Participant

    I suppose so.

    Because ntldr is the one which loads ntoskrnl.exe.
    that means ntldr has a PE parsing functionality and it does dyanamic linking of ntoskrnl and hal.dll

    After that phase it is the responsibility of code present in ntokrnl.exe to dynamically link the other drivers which are getting loaded.
    For this ntoskrnl.exe itself should know its base address.

    Cheers
    Deepak