BOOLEAN CleanUnloadedDrivers()
{
	ULONG bytes = 0;
	NTSTATUS status = ZwQuerySystemInformation(11, 0, bytes, &bytes);

	if (!bytes)
	{
		DbgPrint("CleanUnloadedDrivers: first NtQuerySystemInformation failed, status: 0x%x", status);
		return FALSE;
	}

	PRTL_PROCESS_MODULES modules = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPool, bytes, 0x454E4F45); // 'ENON'

	status = ZwQuerySystemInformation(11, modules, bytes, &bytes);

	if (!NT_SUCCESS(status))
	{
		DbgPrint("CleanUnloadedDrivers: second NtQuerySystemInformation failed, status: 0x%x", status);
		return FALSE;
	}

	PRTL_PROCESS_MODULE_INFORMATION module = modules->Modules;
	UINT64 ntoskrnlBase = 0, ntoskrnlSize = 0;

	for (ULONG i = 0; i < modules->NumberOfModules; i++)
	{
		DbgPrint("CleanUnloadedDrivers: path: %s", module[i].FullPathName);

		if (!strcmp((char*)module[i].FullPathName, "\\SystemRoot\\system32\\ntoskrnl.exe"))
		{
			ntoskrnlBase = (UINT64)module[i].ImageBase;
			ntoskrnlSize = (UINT64)module[i].ImageSize;
			break;
		}
	}

	if (modules)
		ExFreePoolWithTag(modules, 0);

	if (ntoskrnlBase <= 0)
	{
		DbgPrint("CleanUnloadedDrivers: ntoskrnlBase equals zero");
		return FALSE;
	}
	PVOID PiDDBLockPtr = (PVOID)FindPattern((UINT64)ntoskrnlBase, (UINT64)ntoskrnlSize, (UCHAR*)"\x48\x8D\x0D\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x4C\x8B\x8C", "xxx????x????xxx");
	PVOID PiDDBCacheTablePtr = (PVOID)FindPattern((UINT64)ntoskrnlBase, (UINT64)ntoskrnlSize, (UCHAR*)"\x66\x03\xD2\x48\x8D\x0D", "xxxxxx");
	// NOTE: 4C 8B ? ? ? ? ? 4C 8B C9 4D 85 ? 74 + 3] + current signature address = MmUnloadedDrivers
	UINT64 mmUnloadedDriversPtr = FindPattern((UINT64)ntoskrnlBase, (UINT64)ntoskrnlSize, (BYTE*)"\x4C\x8B\x00\x00\x00\x00\x00\x4C\x8B\xC9\x4D\x85\x00\x74", "xx?????xxxxx?x");

	if (!mmUnloadedDriversPtr)
	{
		DbgPrint("CleanUnloadedDrivers: mmUnloadedDriversPtr equals zero");
		return FALSE;
	}

	PERESOURCE PiDDBLock = (PERESOURCE)ResolveRelativeAddress(PiDDBLockPtr, 3, 7);
	PRTL_AVL_TABLE PiDDBCacheTable = (PRTL_AVL_TABLE)ResolveRelativeAddress(PiDDBCacheTablePtr, 6, 10);


	PiDDBCacheTable->TableContext = (PVOID)1;

	UNICODE_STRING cpp;
	RtlInitUnicodeString(&cpp, L"Capcom.sys");
	PiDDBCacheEntry LookupEntry = { 0 };
	LookupEntry.DriverName = cpp;



	ExAcquireResourceExclusiveLite(PiDDBLock, TRUE);


	PiDDBCacheEntry* pFoundEntry = (PiDDBCacheEntry*)RtlLookupElementGenericTableAvl(PiDDBCacheTable, &LookupEntry);
	if (pFoundEntry == NULL)
	{
				ExReleaseResourceLite(PiDDBLock);
		DbgPrint("NO Found Entry");
		return 1;
	}
	DbgPrint("Found Entry");



	if (RemoveEntryList(&pFoundEntry->List))
		DbgPrint("Removed Entry");


	// then delete the element from the avl table
	if (RtlDeleteElementGenericTableAvl(PiDDBCacheTable, pFoundEntry))
		DbgPrint("Removed Table");

	// release the ddb resource lock
	ExReleaseResourceLite(PiDDBLock);



	UINT64 mmUnloadedDrivers = (UINT64)((PUCHAR)mmUnloadedDriversPtr + *(PULONG)((PUCHAR)mmUnloadedDriversPtr + 3) + 7);
	UINT64 bufferPtr = *(UINT64*)mmUnloadedDrivers;

	// NOTE: 0x7D0 is the size of the MmUnloadedDrivers array for win 7 and above
	PVOID newBuffer = ExAllocatePoolWithTag(NonPagedPoolNx, 0x7D0, 0x54446D4D);

	if (!newBuffer)
		return FALSE;

	memset(newBuffer, 0, 0x7D0);


	*(UINT64*)mmUnloadedDrivers = (UINT64)newBuffer;


	ExFreePoolWithTag((PVOID)bufferPtr, 0x54446D4D); // 'MmDT'
	DbgPrint("All Cleaning Done");
	return TRUE;
}