KsepSkipDriverUnloadEventDriverLoad
VOID __stdcall KsepSkipDriverUnloadEventDriverLoad(
UNICODE_STRING *DriverName,
PVOID DriverAddress,
UINT64 DriverSize,
UINT64 DriverTimeStamp,
UINT64 DriverCheckSum){
UINT64 v5;
wchar_t *Buffer;
UINT64 UserDataCount;
struct _EVENT_DATA_DESCRIPTOR UserData;
PVOID *v10;
int v11;
int v12;
int *v13;
int v14;
int v15;
int *v16;
int v17;
int v18;
UINT64 *p_DriverCheckSum;
int v20;
int v21;
PVOID v22;
int v23;
int v24;
v24 = DriverTimeStamp;
v23 = DriverSize;
v22 = DriverAddress;
v5 = *(_QWORD *)KseEtwHandle;
if( *(_QWORD *)KseEtwHandle )
{
if( EtwEventEnabled(
*(UINT64 *)KseEtwHandle,
(EVENT_DESCRIPTOR *)&KseSkipDriverUnloadEventDriverLoad,
(EVENT_DESCRIPTOR *)DriverSize) )
{
Buffer = DriverName->Buffer;
UserData.Reserved = 0;
v12 = 0;
v15 = 0;
v18 = 0;
v21 = 0;
UserData.Ptr = (unsigned __int64)Buffer;
LODWORD(Buffer) = DriverName->Length + 2;
v14 = 4;
UserData.Size = (unsigned int)Buffer;
v10 = &v22;
v13 = &v23;
v16 = &v24;
p_DriverCheckSum = &DriverCheckSum;
LODWORD(UserDataCount) = 5;
v17 = 4;
v20 = 4;
v11 = 8;
EtwWriteEx(
v5,
(EVENT_DESCRIPTOR *)&KseSkipDriverUnloadEventDriverLoad,
0i64,
0i64,
0i64,
0i64,
UserDataCount,
&UserData);
}
}
}Referenced by:
KseSkipDriverUnloadHookDriverTargeted