kernel functions hooking about access HOT 2 CLOSED

Is this for usermode/kernelmode communication? You won't find a function in ntoskrnl not protected by PG. You have to look for a function that calls a function pointer located in .data (or any non-protected memory region) and then simply change that pointer to gain control flow.

The easiest way to find these is to just look at ntoskrnl in IDA with symbols. However, it wouldn't be hard to make a program that automatically scans the kernel for these:

1. Search for call rax (or call _guard_dispatch_icall) instructions in code sections.
2. Backtrack and check if rax was set to a pointer in .data.
3. Filter them with whatever criteria you think is best (which ones can be most easily invoked from usermode but have arguments to easily filter out legitimate calls).

from access.

yes its for usermode/kernelmode communication and many thanks for explanation.

from access.