[rkhunter]

Hi all.

Does anyone remember what function at NT kernel in Win10 responds for calling DriverEntry for loading drivers? I can't find any footprints in IopLoadDriver.

[t4L]

I think you can just have a dummy WDM driver, put a DbgBreak(); in DriverMain() and does a "k" in windbg.

[EP_X0FF]

It should be still there. Look for 0xC0000365 STATUS_FAILED_DRIVER_ENTRY.

[rkhunter]

Thx. I've analyzed it without applying structures and Hex-Rays. Looked for call [register+offset] and forgot about _guard_dispatch_icall.