driver.c

#include <ntddk.h>

#include "InterruptDescriptorTable.h"

const WCHAR deviceNameBuffer[] = L"\\Device\\MyDevice";

PDEVICE_OBJECT g_RootkitDevice; // pointer to device object

NTSTATUS
//STDCALL
_DriverDispatch(IN PDEVICE_OBJECT DeviceObject,
               IN PIRP Irp)
{
    return STATUS_SUCCESS;
}

VOID
//STDCALL
_DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
    DbgPrint("DriverUnload() !\n");
    return;
}

NTSTATUS
_DriverEntry(IN PDRIVER_OBJECT DriverObject,
             IN PUNICODE_STRING RegistryPath)
{
    DbgPrint("DriverEntry() !\n");

    s_idt_info idt_info;        // returned by sidt
    s_idt_entry *idt_entries;   // obtained from idt_info
    unsigned int count;
    unsigned long addr;

    // load idt_info
    __asm ("sidt %0" : "=w" (idt_info));

    idt_entries = (s_idt_entry*) idt_info.Base;

    for(count = 0; count < MAX_IDT_ENTRIES; ++count)
    {
        s_idt_entry *i = &idt_entries[count];

        addr = MAKELL(i->HighOffset, i->LowOffset);

        DbgPrint("Interrupt %d, %llu", count, addr);
    }

    DriverObject->DriverUnload = _DriverUnload;

    return STATUS_SUCCESS;
}