| 3 | #include "FilterCallbacks.h" |
| 4 | |
| 5 | VOID OnDriverLoad(PDRIVER_OBJECT DriverObject, PDEVICE_OBJECT DeviceObject, PFLT_FILTER FilterHandle, PUNICODE_STRING RegistryPath) |
| 6 | { |
| 7 | UNREFERENCED_PARAMETER(DriverObject); |
| 8 | UNREFERENCED_PARAMETER(DeviceObject); |
| 9 | UNREFERENCED_PARAMETER(RegistryPath); |
| 10 | |
| 11 | PEPROCESS pCurrProc = PsGetCurrentProcess(); |
| 12 | SysInfoLog("[NoMercy]: Driver initialize routine(%s) called! Process : %lld (%p)\n", __FUNCTION__, reinterpret_cast<UINT64>(PsGetCurrentProcessId()), pCurrProc); |
| 13 | |
| 14 | if (FilterHandle) |
| 15 | { |
| 16 | // Start filter server communication |
| 17 | NTSTATUS ntStatus = Communication::StartServer(FilterHandle); |
| 18 | if (!NT_SUCCESS(ntStatus)) |
| 19 | { |
| 20 | SysErrorLog("Filter communication server start fail! Status: 0x%X\n", ntStatus); |
| 21 | return; |
| 22 | } |
| 23 | |
| 24 | // Register Handle protection |
| 25 | ntStatus = KbCallbacks::StartObHandlesFilter(); |
| 26 | if (!NT_SUCCESS(ntStatus)) |
| 27 | { |
| 28 | SysErrorLog("OB Callback initilization fail! Status: 0x%X\n", ntStatus); |
| 29 | return; |
| 30 | } |
| 31 | |
| 32 | // Register notify callbacks |
| 33 | ntStatus = KbCallbacks::StartPsProcessFilter(); |
| 34 | if (!NT_SUCCESS(ntStatus)) |
| 35 | { |
| 36 | SysErrorLog("Process Callback initilization fail! Status: 0x%X\n", ntStatus); |
| 37 | return; |
| 38 | } |
| 39 | |
| 40 | ntStatus = KbCallbacks::StartPsThreadFilter(); |
| 41 | if (!NT_SUCCESS(ntStatus)) |
| 42 | { |
| 43 | SysErrorLog("Thread Callback initilization fail! Status: 0x%X\n", ntStatus); |
| 44 | return; |
| 45 | } |
| 46 | |
| 47 | ntStatus = KbCallbacks::StartPsImageFilter(); |
| 48 | if (!NT_SUCCESS(ntStatus)) |
| 49 | { |
| 50 | SysErrorLog("Image Callback initilization fail! Status: 0x%X\n", ntStatus); |
| 51 | return; |
| 52 | } |
| 53 | |
| 54 | SysInfoLog("[NoMercy]: Driver initialize completed!\n"); |
| 55 | } |
| 56 | } |
| 57 | |
| 58 | VOID OnDriverUnload(PDRIVER_OBJECT DriverObject, PDEVICE_OBJECT DeviceObject) |
| 59 | { |
no test coverage detected