UserSharedData _KUSER_SHARED_DATA DATA XREF: LdrpGenSecurit圜ookie+4A↓rĪfter that I changed the original disassembly line: mov eax, 7FFE0030h It looks like this: _user_shared_data segment para public '' use64Īssume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing I declared the segment with the current size of the struct (0x720) to fit it snugly. Now, UserSharedData is a struct (based on the imported standard struct _KUSER_SHARED_DATA) which resides in its own segment which I declared at 0x7FFE0000.

The color of the second return value suggested something was wrong, so I went ahead and made the address known to IDA.

Return (NtCurrentPeb()->SharedData + 30) When I originally decompiled this code, it looked somewhat like this (even without the cast on the second return): PCWSTR _stdcall RtlGetNtSystemRoot() (NB: ReadFromPEB is uninteresting for this discussion.) Mov eax, offset UserSharedData.NtSystemRoot was 7FFE0030h instead of the offset RtlGetNtSystemRoot proc near CODE XREF: LdrpBuildSystem32FileName+1A↑p

Ida hex rays