#include "load_Image_callback.h"

namespace load_image_notify_routine
{
	VOID load_image_notify_routine(
		PUNICODE_STRING FullImageName,
		HANDLE ProcessId,
		PIMAGE_INFO ImageInfo
	)
	{	
		UNREFERENCED_PARAMETER(ProcessId);
		UNREFERENCED_PARAMETER(ImageInfo);

		if (FullImageName->Buffer)
		{

			if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
			{
				DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);

				ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);

			}

		}
	}



	auto create_image_load_notify_routine() -> NTSTATUS
	{
		return PsSetLoadImageNotifyRoutine(load_image_notify_routine);
	}
	auto remove_image_load_notify_routine() -> NTSTATUS
	{
		return PsRemoveLoadImageNotifyRoutine(load_image_notify_routine);
	}
}