Theodosius/Examples/DemoDrv/DriverEntry.cpp

#include "Theodosius.h"
#include "Types.h"

// this routine is not obfuscated...
void PrintCR3()
{
	ULONG_PTR Cr3Value =
		*reinterpret_cast<ULONG_PTR*>(
			IoGetCurrentProcess() + CR3_OFFSET);

	DbgPrint("> Current CR3 = 0x%p\n", Cr3Value);
}

ObfuscateRoutine void LoopDemo()
{
	// JCC's work! :)
	for (auto idx = 0u; idx < 10; ++idx)
		DbgPrint("> Loop Demo: %d\n", idx);
}

// entry point must be named "DrvEntry" for this example...
MutateRoutine extern "C" void DrvEntry()
{
	DbgPrint("> Hello World!\n");

	// non-exported symbols being resolved by jit linker...
	DbgPrint("> PiDDBCacheTable = 0x%p\n", &PiDDBCacheTable);
	DbgPrint("> win32kfull!NtUserRegisterShellPTPListener = 0x%p\n", &NtUserRegisterShellPTPListener);

	// example of referencing itself...
	DbgPrint("> DrvEntry = 0x%p\n", &DrvEntry);

	// example of calling other obfuscated/non obfuscated routines...
	PrintCR3();
	LoopDemo();
}