style
This commit is contained in:
@@ -2,6 +2,10 @@
|
||||
|
||||
namespace load_image_notify_routine
|
||||
{
|
||||
|
||||
typedef NTSTATUS(__fastcall* fnMmUnloadSystemImage)(PVOID ImageBase);
|
||||
fnMmUnloadSystemImage _MmUnloadSystemImage = (fnMmUnloadSystemImage)0xfffff800042748a0;
|
||||
|
||||
VOID load_image_notify_routine(
|
||||
PUNICODE_STRING FullImageName,
|
||||
HANDLE ProcessId,
|
||||
@@ -16,10 +20,13 @@ namespace load_image_notify_routine
|
||||
|
||||
if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
|
||||
{
|
||||
DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
|
||||
//DbgBreakPoint();
|
||||
|
||||
ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
|
||||
//DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
|
||||
|
||||
//auto status = _MmUnloadSystemImage(ImageInfo->ImageBase);
|
||||
|
||||
//DbgPrintEx(77, 0, "%x\n", status);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user