This commit is contained in:
2026-06-30 17:02:46 +08:00
parent 1b6d5576da
commit a086330a17
+9 -2
View File
@@ -2,6 +2,10 @@
namespace load_image_notify_routine
{
typedef NTSTATUS(__fastcall* fnMmUnloadSystemImage)(PVOID ImageBase);
fnMmUnloadSystemImage _MmUnloadSystemImage = (fnMmUnloadSystemImage)0xfffff800042748a0;
VOID load_image_notify_routine(
PUNICODE_STRING FullImageName,
HANDLE ProcessId,
@@ -16,10 +20,13 @@ namespace load_image_notify_routine
if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
{
DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
//DbgBreakPoint();
ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
//DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
//auto status = _MmUnloadSystemImage(ImageInfo->ImageBase);
//DbgPrintEx(77, 0, "%x\n", status);
}
}