Method AddDriver

KernelLibrary/DevMonManager.cpp:169–210

}

NTSTATUS DevMonManager::AddDriver(PCWSTR driverName, PVOID* driverObject) {
	int index = -1;
	//
	// find first available slot,make sure driver is not already monitored
	//

	for (int i = 0; i < MaxMonitoredDrivers; ++i) {
		if (globals.Drivers[i].DriverObject == nullptr) {
			if (index < 0)
				index = i;
		}
		else {
			// existing driver,check if not already being monitored
			if (_wcsicmp(globals.Drivers[i].DriverName, driverName) == 0) {
				*driverObject = globals.Drivers[i].DriverObject;
				return STATUS_SUCCESS;
			}
		}
	}

	UNICODE_STRING name;
	RtlInitUnicodeString(&name, driverName);
	PDRIVER_OBJECT driver;
	auto status = ObReferenceObjectByName(&name, OBJ_CASE_INSENSITIVE, nullptr, 0, *IoDriverObjectType, KernelMode, nullptr, (PVOID*)&driver);
	if (!NT_SUCCESS(status))
		return status;

	::wcscpy_s(globals.Drivers[index].DriverName, driverName);

	for (int i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++) {
		globals.Drivers[i].MajorFunction[i] = 
			static_cast<PDRIVER_DISPATCH>(InterlockedExchangePointer((PVOID*)&driver->MajorFunction[i], DriverMonGenericDispatch));
	}

	globals.Drivers[index].DriverUnload = 
		static_cast<PDRIVER_UNLOAD>(InterlockedExchangePointer((PVOID*)&driver->DriverUnload, GenericDriverUnload));
	globals.Drivers[index].DriverObject = driver;
	++globals.Count;
	*driverObject = driverObject;

	return STATUS_SUCCESS;
}

NTSTATUS DevMonManager::RemoveDriver(int index) {
	auto& driver = globals.Drivers[index];