| 126 | } |
| 127 | |
| 128 | KbLdrStatus WINAPI KbRtlLoadModuleMemory(PVOID DriverImage, LPCWSTR ModuleName, OUT WdkTypes::HMODULE* ImageBase) |
| 129 | { |
| 130 | try { |
| 131 | PELoader Loader( |
| 132 | static_cast<HMODULE>(DriverImage), |
| 133 | [](LPCSTR LibName, LPCSTR FunctionName) -> PVOID { |
| 134 | PVOID Address = GetKernelProcAddress(FunctionName); |
| 135 | if (!Address) throw KbLdrImportNotResolved; |
| 136 | return Address; |
| 137 | }, |
| 138 | [](LPCSTR LibName, WORD Ordinal) -> PVOID { |
| 139 | throw KbLdrOrdinalImportNotSupported; |
| 140 | } |
| 141 | ); |
| 142 | |
| 143 | PEAnalyzer Module(Loader.get(), FALSE); |
| 144 | |
| 145 | WdkTypes::HMODULE hModule = NULL; |
| 146 | BOOL Status = VirtualMemory::KbAllocKernelMemory(Loader.getDeployedSize(), TRUE, &hModule); |
| 147 | if (!Status) throw KbLdrKernelMemoryNotAllocated; |
| 148 | |
| 149 | Loader.relocate(reinterpret_cast<HMODULE>(hModule)); |
| 150 | |
| 151 | Status = VirtualMemory::KbCopyMoveMemory( |
| 152 | hModule, |
| 153 | reinterpret_cast<WdkTypes::PVOID>(Loader.get()), |
| 154 | Loader.getDeployedSize(), |
| 155 | FALSE |
| 156 | ); |
| 157 | |
| 158 | if (!Status) { |
| 159 | VirtualMemory::KbFreeKernelMemory(hModule); |
| 160 | return KbLdrTransitionFailure; |
| 161 | } |
| 162 | |
| 163 | WdkTypes::PVOID ModuleBase = reinterpret_cast<WdkTypes::PVOID>(Module.getImageBase()); |
| 164 | WdkTypes::PVOID OnLoad = NULL, OnUnload = NULL, OnDeviceControl = NULL; |
| 165 | const auto& Exports = Module.getExportsInfo(); |
| 166 | for (const auto& Export : Exports.exports) { |
| 167 | WdkTypes::PVOID VA = hModule + static_cast<WdkTypes::PVOID>(Export.rva); |
| 168 | if (Export.name == "OnLoad") { |
| 169 | OnLoad = VA; |
| 170 | } else if (Export.name == "OnUnload") { |
| 171 | OnUnload = VA; |
| 172 | } else if (Export.name == "OnDeviceControl") { |
| 173 | OnDeviceControl = VA; |
| 174 | } |
| 175 | } |
| 176 | |
| 177 | Status = LoadableModules::KbLoadModule( |
| 178 | hModule, |
| 179 | ModuleName, |
| 180 | OnLoad, |
| 181 | OnUnload, |
| 182 | OnDeviceControl |
| 183 | ); |
| 184 | |
| 185 | if (!Status) { |
no test coverage detected