[Release] - Win7 GetKiAttachProcessAddr

ULONG GetKiAttachProcess()
{
UCHAR *cPtr, *pOpcode;
ULONG Length, CallCount = 0;
ULONG uKeAttachProcess = 0;
ULONG uKiAttachProcess = 0;

uKeAttachProcess = GetFuncAddr_FuncName(L"KeAttachProcess");
if (uKeAttachProcess == 0) return;
for (cPtr = (PUCHAR)uKeAttachProcess; cPtr < (PUCHAR)uKeAttachProcess + PAGE_SIZE; cPtr += Length) 
{
  Length = SizeOfCode(cPtr, &pOpcode);
  if (!Length) return; 
  if (*pOpcode == 0xE8)
  {
   CallCount=CallCount+1;
   if (CallCount==2)
   {
    uKiAttachProcess = (*(PULONG)(pOpcode+1)+(ULONG)cPtr + 5);
    return uKiAttachProcess;
   }
  }
}
}