Here is my code which I got from Microsoft "Hello World" KMDF webpage:
#include <ntddk.h>
#include <wdf.h>
DRIVER_INITIALIZE DriverEntry;
EVT_WDF_DRIVER_DEVICE_ADD KmdfHelloWorldEvtDeviceAdd;
DRIVER_UNLOAD DriverUnload;
// This is my custom declared function
VOID KernelModeFunction(VOID);
// Callback function implementation
VOID MyLoadImageNotifyRoutine(
In_opt PUNICODE_STRING FullImageName,
In HANDLE ProcessId,
In PIMAGE_INFO ImageInfo
)
{
// Process the image load notification.
// Access the image name (FullImageName), process ID (ProcessId), and image information (ImageInfo).
UNREFERENCED_PARAMETER(ImageInfo);
if (FullImageName != NULL) {
// Handle the image load event.
// For example, log the image name and process ID.
DbgPrint("KernelProt: Image loaded: %wZ, Process ID: %d\n", FullImageName, ProcessId);
DbgPrint("Address of KernelModeFunction is %x\n", KernelModeFunction);
}
}
NTSTATUS
DriverEntry
(
In PDRIVER_OBJECT DriverObject,
In PUNICODE_STRING RegistryPath
)
{
// NTSTATUS variable to record success or failure
NTSTATUS status = STATUS_SUCCESS;
// Allocate the driver configuration object
WDF_DRIVER_CONFIG config;
// Print "Hello World" for DriverEntry
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: DriverEntry\n"));
// Initialize the driver configuration object to register the
// entry point for the EvtDeviceAdd callback, KmdfHelloWorldEvtDeviceAdd
WDF_DRIVER_CONFIG_INIT(&config,
KmdfHelloWorldEvtDeviceAdd
);
// Finally, create the driver object
status = WdfDriverCreate(DriverObject,
RegistryPath,
WDF_NO_OBJECT_ATTRIBUTES,
&config,
WDF_NO_HANDLE
);
// register our MyLoadImageNotifyRoutine
status = PsSetLoadImageNotifyRoutine(MyLoadImageNotifyRoutine);
// register our driver unload function
DriverObject->DriverUnload = DriverUnload;
return status;
}
NTSTATUS
KmdfHelloWorldEvtDeviceAdd(
In WDFDRIVER Driver,
Inout PWDFDEVICE_INIT DeviceInit
)
{
// We're not using the driver object,
// so we need to mark it as unreferenced
UNREFERENCED_PARAMETER(Driver);
NTSTATUS status;
// Allocate the device object
WDFDEVICE hDevice;
// Print "Hello World"
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "KmdfHelloWorld: KmdfHelloWorldEvtDeviceAdd\n"));
// Create the device object
status = WdfDeviceCreate(&DeviceInit,
WDF_NO_OBJECT_ATTRIBUTES,
&hDevice
);
return status;
}
void DriverUnload
(
In PDRIVER_OBJECT DriverObject
)
{
UNREFERENCED_PARAMETER(DriverObject);
// remove the registered callback function
PsRemoveLoadImageNotifyRoutine(MyLoadImageNotifyRoutine);
KdPrint(("KernelProt DriverUnload has been called\r\n"));
}
VOID KernelModeFunction(VOID)
{
}