entry.cpp

#include "detector.hpp"

using namespace kstd;

extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    UNREFERENCED_PARAMETER(DriverObject);
    UNREFERENCED_PARAMETER(RegistryPath);

    FLOG_INFO("DriverEntry called . . .");

    NTSTATUS status = STATUS_SUCCESS;

    /*ULONG modulesSize = 0;
    status = ZwQuerySystemInformation(SystemInformationClass::SystemModuleInformationClass, NULL, 0, &modulesSize);
    if (status != STATUS_INFO_LENGTH_MISMATCH) {
        LOG_INFO("Failed to query system module information size");
        return status;
    }

    SystemModules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, modulesSize, 'modl');
    if (!SystemModules) {
        LOG_INFO("Failed to allocate memory for system modules");
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    status = ZwQuerySystemInformation(SystemInformationClass::SystemModuleInformationClass, SystemModules, modulesSize, &modulesSize);
    if (!NT_SUCCESS(status)) {
        LOG_INFO("Failed to query system module information");
        ExFreePoolWithTag(SystemModules, 'modl');
        return status;
    }
    LOG_INFO("Ok . . .");
    //MemoryScan(); // just for the lulz

    //ExFreePoolWithTag(SystemModules, 'modl');

    */

    return status;
}