How to get base address of ntdll.dll under kernel Windows 8

NTDEV
10

your algorithm not the best. not need open file. section \KnownDlls\ntdll.dll already exist

NTSTATUS LookforNtdll(void** ppv)
{
NTSTATUS status;
STATIC_OBJECT_ATTRIBUTES(oa, “\KnownDlls\ntdll.dll”);
HANDLE hSection;
if (0 <= (status = ZwOpenSection(&hSection, SECTION_QUERY, &oa)))
{
SECTION_IMAGE_INFORMATION sii;
if (0 <= (status = ZwQuerySection(hSection, SectionImageInformation, &sii, sizeof(sii), 0)))
{
*ppv = sii.TransferAddress;
}
ZwClose(hSection);
}

return status;
}