11{
23
27 return;
28
29
34
42
43
48
53
59
64
71
72
77
82
88
93
100
101
106
111
117
122
129
130
135
140
146
151
158
159
164
172
173
178
183
189
194
201
202
207
212
218
223
230
231
236
241
247
252
259
260
265
270
276
281
288
291}
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
NTSTATUS NTAPI NtMapViewOfSection(IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
static UNICODE_STRING InitOnCreate
static UNICODE_STRING InitOnRW
static UNICODE_STRING InvalidInit
#define ok_eq_hex(value, expected)
#define ok_eq_int(value, expected)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define NT_SUCCESS(StatCode)
#define FILE_ATTRIBUTE_NORMAL
#define FILE_SYNCHRONOUS_IO_NONALERT
_Must_inspect_result_ _Out_ PLARGE_INTEGER FileSize
#define OBJ_CASE_INSENSITIVE
#define KmtEndSeh(ExpectedStatus)
static OUT PIO_STATUS_BLOCK IoStatusBlock
#define InitializeObjectAttributes(p, n, a, r, s)
#define SECTION_ALL_ACCESS
#define NtCurrentProcess()
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
NTSTATUS NTAPI NtCreateFile(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength)
#define STATUS_INVALID_FILE_FOR_SECTION
DWORD KmtLoadAndOpenDriver(IN PCWSTR ServiceName, IN BOOLEAN RestartIfRunning)
VOID KmtCloseDriver(VOID)
VOID KmtUnloadDriver(VOID)
#define RTL_CONSTANT_STRING(s)