#include "Theodosius.h" #include "Types.h" // this routine is not obfuscated... void PrintCR3() { ULONG_PTR Cr3Value = *reinterpret_cast( IoGetCurrentProcess() + CR3_OFFSET); DbgPrint("> Current CR3 = 0x%p\n", Cr3Value); } ObfuscateRoutine void LoopDemo() { // JCC's work! :) for (auto idx = 0u; idx < 10; ++idx) DbgPrint("> Loop Demo: %d\n", idx); } // entry point must be named "DrvEntry" for this example... MutateRoutine extern "C" void DrvEntry() { DbgPrint("> Hello World!\n"); // non-exported symbols being resolved by jit linker... DbgPrint("> PiDDBCacheTable = 0x%p\n", &PiDDBCacheTable); DbgPrint("> win32kfull!NtUserRegisterShellPTPListener = 0x%p\n", &NtUserRegisterShellPTPListener); // example of referencing itself... DbgPrint("> DrvEntry = 0x%p\n", &DrvEntry); // example of calling other obfuscated/non obfuscated routines... PrintCR3(); LoopDemo(); }