#include <ntddk.h>
void UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
DbgPrint("Driver initialized\n");
UNREFERENCED_PARAMETER(RegistryPath);
DriverObject->DriverUnload = UnloadDriver;
HANDLE hEvent;
UNICODE_STRING EventName;
RtlInitUnicodeString(&EventName, L"\\KernelObjects\\LowNonPagedPoolCondition");
PKEVENT event = IoCreateNotificationEvent(&EventName,&hEvent);
if (!event) {
DbgPrint("Error creating event: %lx\n", GetLastError());
return STATUS_UNSUCCESSFUL;
}
DbgPrint("Event status [%d]", KeReadStateEvent(event));
NTSTATUS status = KeWaitForSingleObject(event, Executive, KernelMode, FALSE, NULL);
if (!NT_SUCCESS(status)) {
DbgPrint("Error waiting for event: %lx\n", status);
}
ZwClose(hEvent);
ZwClose(event); //Close the event object itself
return STATUS_SUCCESS;
}
void UnloadDriver(PDRIVER_OBJECT DriverObject) {
UNREFERENCED_PARAMETER(DriverObject);
DbgPrint("Driver Unloaded\n");
}
I'll go straight to the problem I don't think here the code gets a handle or pointer to the event object, (.png).
I am new to this so I would appreciate your insights, I copied this from a book teaching Windows kernel programming, while I have zero experience in this type of things I managed to do some progress .