The code explained on my blog post Windows Kernel Shellcode
Three different shellcode techniques on the Windows Kernel