* Description: * ConvertAnsiToUnicode is responsible for converting ANSI string to UNICODE. * * Parameters: * @ansiString [PCHAR] -- Source string t

* Description: * COFFLdr::Execute is responsible for executing the COFF's main function. * * Parameters: * There are no parameters * * Returns: * @sta

* Description: * FindPattern is responsible for finding a pattern in memory range. * * Parameters: * @pattern [PCUCHAR] -- Pattern to search fo

* Description: * GetFunctionAddress is responsible for getting the function address inside given module from its EAT. * * Parameters: * @moduleBase

* Description: * GetModuleBase is responsible for getting the base address of given module inside a given process. * * Parameters: * @Process [PEPR

* Description: * GetSSDTAddress is responsible for getting the SSDT's location. * * Parameters: * There are no parameters. * * Returns: * @status [NTS

* Description: * GetSSDTFunctionAddress is responsible for getting the SSDT's location. * * Parameters: * There are no parameters. * * Returns: * @sta

* Description: * COFFLdr::IsInitialized returning whether the initialization was successful or not. * * Parameters: * There are no parameters * * Retu

* Description: * COFFLdr::Load is responsible for loading COFF into the driver's memory. * * Parameters: * There are no parameters * * Returns: * @sta

* Description: * JormungandrCreateClose is responsible for returning STATUS_SUCCESS for an IRP. * * Parameters: * @DeviceObject [PDEVICE_OBJECT] -- Un

* Description: * JormungandrWrite is responsible for handling writing operation to the driver and managing the COFF. * * Parameters: * @DeviceObject [

* Description: * COFFLdr::ProcessSections is responsible for processing the COFF's sections and creating a valid section map. * * Parameters: * There

* Description: * COFFLdr::ProcessSymbol is responsible for getting a function address by its name. This function can be either from ntdll or ntoskrnl.