//
// thanks to gareth for the idea
// http://www.rootkit.com/newsread.php?newsid=248
//

#include "stdafx.h"

DWORD GrabService(IN CHAR *FunctionName)
{
	DWORD Exp = (DWORD) GetProcAddress(
		GetModuleHandle(_T("ntdll.dll")), FunctionName);

	Exp++; // mov opcode

	DWORD *ptr = (DWORD *) Exp;

	return *ptr;
}