Function DriverEntry

Driver/main.cpp:124–219

NTSTATUS DriverEntry(EntryParams* params) //damn this needs serious fixing... it's clunky
{
	if (!params)
		return STATUS_FAILED_DRIVER_ENTRY;

	printf("[mapper] Driver Entry: %xll Image Base: %xll Size: %xll\n", params->entryPoint, params->poolBase, params->size);

#pragma region win32base.sys
	auto win32kbase = Core::GetSystemModuleBase("\\SystemRoot\\System32\\win32kbase.sys");
	{

		if (!win32kbase) 
		{
			printf("[mapper] Failed to get Base Address!\n");
			return STATUS_FAILED_DRIVER_ENTRY;
		}

		printf("[mapper] win32kbase.sys -> 0x%p\n", win32kbase);
	}
#pragma endregion
#pragma region ApiSetEditionSetProcessWindowStationEntryPoint

	auto ApiSetEditionSetProcessWindowStationEntryPointAddress = Util::FindPattern(
		win32kbase, 
		"\xE8\x00\x00\x00\x00\x48\x98\x48\x83\xC4\x28\xC3\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x70\x10", 
		"x????xxxxxxxxxxxxxxxxxxxxxxxxxx");
	{
		if (!ApiSetEditionSetProcessWindowStationEntryPointAddress)
		{
			printf("[mapper] Unable to find ApiSetEditionSetProcessWindowStationEntryPoint signature!\n");
			return STATUS_FAILED_DRIVER_ENTRY;
		}
		ApiSetEditionSetProcessWindowStationEntryPointAddress = RVA(ApiSetEditionSetProcessWindowStationEntryPointAddress, 5);
		printf("[mapper] ApiSetEditionSetProcessWindowStationEntryPoint -> 0x%p\n", ApiSetEditionSetProcessWindowStationEntryPointAddress);
	}

	auto ApiSetEditionSetProcessWindowStationEntryPointDataPointer = RVA(ApiSetEditionSetProcessWindowStationEntryPointAddress + 0x5E, 7);
	{
		if (!ApiSetEditionSetProcessWindowStationEntryPointDataPointer)
		{
			printf("[mapper] Invalid ApiSetEditionSetProcessWindowStationEntryPoint Data Pointer!\n");
			return STATUS_FAILED_DRIVER_ENTRY;
		}
		printf("[mapper] ApiSetEditionSetProcessWindowStationEntryPoint Data Pointer -> 0x%p\n", 
			ApiSetEditionSetProcessWindowStationEntryPointAddress);
	}
#pragma endregion
#pragma region ApiSetEnsurePointerDeviceHasMonitor
	auto ApiSetEnsurePointerDeviceHasMonitorAddress = Util::FindPattern(win32kbase, "\xE8\x00\x00\x00\x00\x85\xC0\x75\x43", "x????xxxx");
	{
		if (!ApiSetEnsurePointerDeviceHasMonitorAddress) 
		{
			printf("[mapper] Unable to find ApiSetEnsurePointerDeviceHasMonitor signature!\n");
			return STATUS_FAILED_DRIVER_ENTRY;
		}
		ApiSetEnsurePointerDeviceHasMonitorAddress = RVA(ApiSetEnsurePointerDeviceHasMonitorAddress, 5);
		printf("[mapper] ApiSetEnsurePointerDeviceHasMonitor -> 0x%p\n", ApiSetEnsurePointerDeviceHasMonitorAddress);
	}