40 lines
777 B
C++
40 lines
777 B
C++
#include "load_Image_callback.h"
|
|
|
|
namespace load_image_notify_routine
|
|
{
|
|
VOID load_image_notify_routine(
|
|
PUNICODE_STRING FullImageName,
|
|
HANDLE ProcessId,
|
|
PIMAGE_INFO ImageInfo
|
|
)
|
|
{
|
|
UNREFERENCED_PARAMETER(ProcessId);
|
|
UNREFERENCED_PARAMETER(ImageInfo);
|
|
|
|
if (FullImageName->Buffer)
|
|
{
|
|
|
|
if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
|
|
{
|
|
DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
|
|
|
|
ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
|
|
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
auto create_image_load_notify_routine() -> NTSTATUS
|
|
{
|
|
return PsSetLoadImageNotifyRoutine(load_image_notify_routine);
|
|
}
|
|
auto remove_image_load_notify_routine() -> NTSTATUS
|
|
{
|
|
return PsRemoveLoadImageNotifyRoutine(load_image_notify_routine);
|
|
}
|
|
}
|
|
|