| 137 | |
| 138 | |
| 139 | NTSTATUS EntryPoint(ULONG64 mdl, ULONG64 code, ULONG64 output, ULONG64 PID) |
| 140 | { |
| 141 | OUTPUT_ADDRESS = output; |
| 142 | CODE_ADDRESS = code; |
| 143 | |
| 144 | MDL* mdlptr = reinterpret_cast<MDL*>(mdl); |
| 145 | if (!null_pfn(mdlptr)) { |
| 146 | return STATUS_UNSUCCESSFUL; |
| 147 | } |
| 148 | HANDLE thread_handle = nullptr; |
| 149 | print("[+] PID: %d", PID); |
| 150 | print("[+] code: %d", code); |
| 151 | print("[+] output: %d", output); |
| 152 | process::pid = PID; |
| 153 | |
| 154 | OBJECT_ATTRIBUTES object_attribues{ }; |
| 155 | InitializeObjectAttributes(&object_attribues, nullptr, OBJ_KERNEL_HANDLE, nullptr, nullptr); |
| 156 | |
| 157 | NTSTATUS status = PsCreateSystemThread(&thread_handle, 0, &object_attribues, nullptr, nullptr, reinterpret_cast<PKSTART_ROUTINE>(&mainthread), nullptr); |
| 158 | //ZwClose(thread_handle); |
| 159 | //print("\n[+] Bye bye DriverEntry!"); |
| 160 | return STATUS_UNSUCCESSFUL; |
| 161 | } |
| 162 | |
| 163 | //NTSTATUS DriverEntry(PDRIVER_OBJECT driver_object, PUNICODE_STRING registry_path) { |
| 164 | // |
nothing calls this directly
no test coverage detected