#define DRIVER_NAME L"MsIo64"
#define DRIVER_PATH L"\\??\\C:\\Windows\\System32\\drivers\\MsIo64.sys"
// Create registry entry for driver
// ------------------------------------------------------------------------
BOOL create_driver_reg_entry(LPCWSTR driverName, LPCWSTR driverPath) {
// Init some important stuff
wchar_t keyPath[MAX_PATH];
OBJECT_ATTRIBUTES objectAttributes = { 0 };
UNICODE_STRING errorControlU;
DWORD errorControlValue = 0; // Do not show warning
DWORD startValue = 3; // Load on demand
DWORD typeValue = 1; // Kernel device driver
UNICODE_STRING imagePathU;
LPCWSTR imagePathValue = driverPath;
SIZE_T imagePathSize = ((((DWORD)lstrlenW(imagePathValue) + 1)) * 2);
// Convert driver registry service key to unicode
swprintf(keyPath, MAX_PATH, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\%ls", driverName);
RtlInitUnicodeString(&keyPathU, keyPath);
// Create driver registry service key
objectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
objectAttributes.ObjectName = &keyPathU;
status = NtCreateKey(&keyHandle, KEY_ALL_ACCESS, &objectAttributes, 0, NULL, REG_OPTION_NON_VOLATILE, NULL);
if (status != STATUS_SUCCESS) {
printf("[-] NtCreateKey error: 0x%X\n", status); // [DBG]
// Convert ErrorControl subkey to unicode
RtlInitUnicodeString(&errorControlU, L"ErrorControl");
// Set up ErrorControl subkey
status = NtSetValueKey(keyHandle, &errorControlU, 0, REG_DWORD, &errorControlValue, sizeof(errorControlValue));
if (status != STATUS_SUCCESS) {
printf("[-] NtSetValueKey1 error: 0x%X\n", status); // [DBG]
// Convert Start subkey to unicode
RtlInitUnicodeString(&startU, L"Start");
status = NtSetValueKey(keyHandle, &startU, 0, REG_DWORD, &startValue, sizeof(startValue));
if (status != STATUS_SUCCESS) {
printf("[-] NtSetValueKey2 error: 0x%X\n", status); // [DBG]
// Convert Type subkey to unicode
RtlInitUnicodeString(&typeU, L"Type");
status = NtSetValueKey(keyHandle, &typeU, 0, REG_DWORD, &typeValue, sizeof(typeValue));
if (status != STATUS_SUCCESS) {
printf("[-] NtSetValueKey3 error: 0x%X\n", status); // [DBG]
// Convert ImagePath subkey to unicode
RtlInitUnicodeString(&imagePathU, L"ImagePath");
// Set up ImagePath subkey
status = NtSetValueKey(keyHandle, &imagePathU, 0, REG_EXPAND_SZ, (LPVOID)imagePathValue, imagePathSize);
if (status != STATUS_SUCCESS) {
printf("[-] NtSetValueKey4 error: 0x%X\n", status); // [DBG]
// To load a driver from disk
// Needs SE_LOAD_DRIVER_NAME privilege enabled in process token
// Needs driver registry service key to be set
// ------------------------------------------------------------------------
BOOL load_driver(LPCWSTR driverName) {
// Init some important stuff
wchar_t keyPath[MAX_PATH];
// Convert driver registry service key to unicode
swprintf(keyPath, MAX_PATH, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\%ls", driverName);
RtlInitUnicodeString(&keyPathU, keyPath);
status = NtLoadDriver(&keyPathU);
if (status == STATUS_IMAGE_ALREADY_LOADED || status == STATUS_OBJECT_NAME_COLLISION || status != STATUS_SUCCESS) {
printf("[-] Driver may already be loaded, please unload it to continue!\n"); // [DBG]
printf("[-] NtLoadDriver error: 0x%X\n", status); // [DBG]
// To unload a loaded driver
// Needs SE_LOAD_DRIVER_NAME privilege enabled in process token
// Needs driver registry service key to be set
// ------------------------------------------------------------------------
BOOL unload_driver(LPCWSTR driverName) {
// Init some important stuff
wchar_t keyPath[MAX_PATH];
// Convert driver registry service key to unicode
swprintf(keyPath, MAX_PATH, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\%ls", driverName);
RtlInitUnicodeString(&keyPathU, keyPath);
status = NtUnloadDriver(&keyPathU);
if (status != STATUS_SUCCESS) {
printf("[-] NtUnloadDriver error: 0x%X\n", status); // [DBG]