Use WinDbg to get the index of the SSDT function table and calculate the address

When entering RING0 from Ring3, the desired SSDT index is placed in the register EAX.
So here we get the index number of the function in SSDT through the content of eax, and then calculate its address
First open the Windbug, we take the function Zwqueryobject as an example:

From mov eax 0f8h, know our index number is 0f8h.
To verify, see if the function Zwqueryobject.

Let's get to SSDT's address first:

The first 8488a43c is the base address of SSDT, and we know that the address of the function equals the SSDT base site
+4* index number, figure out the function pointer address is 8488A81C

Finally u 84a0e0b5 get disassembled see we got zwqueryobject right

These two days to learn a great God's SSDT hook next time to post it as an experience

Use WinDbg to get the index of the SSDT function table and calculate the address