Theodosius/demos/DemoDrv/DriverEntry.cpp

#include "Theodosius.h"
#include "Types.h"

// this routine is not obfuscated...
void PrintCR3()
{
	ULONG_PTR Cr3Value =
		*reinterpret_cast<ULONG_PTR*>(
			IoGetCurrentProcess() + CR3_OFFSET);

	DbgPrint("> Current CR3 = 0x%p\n", Cr3Value);
}

ObfuscateRoutine 
void LoopDemo(bool* result)
{
	// JCC's work! :)
	for (auto idx = 0u; idx < 10; ++idx)
		DbgPrint("> Loop Demo: %d\n", idx);

	*result = true;
}

MutateRoutine extern "C" void DrvEntry()
{
	DbgPrint("> Hello World!\n");

	// non-exported symbols being resolved by jit linker...
	DbgPrint("> PiDDBCacheTable = 0x%p\n", &PiDDBCacheTable);
	DbgPrint("> win32kfull!NtUserRegisterShellPTPListener = 0x%p\n", &NtUserRegisterShellPTPListener);

	// example of referencing itself...
	DbgPrint("> DrvEntry = 0x%p\n", &DrvEntry);

	// example of calling other obfuscated/non obfuscated routines...
	PrintCR3();

	bool result = false;
	LoopDemo(&result);
	DbgPrint("> result = %d\n", result);
}