diff --git a/src/Domito.cpp b/src/Domito.cpp index 72939df..1a113c6 100644 --- a/src/Domito.cpp +++ b/src/Domito.cpp @@ -27,6 +27,15 @@ _IRQL_requires_max_(PASSIVE_LEVEL) NTSTATUS DomitoInit() { + // + // Do those first since the follow-up code depends on them + // + + G_Common.ZwQueryInformationProcess = + (t_ZwQueryInformationProcess)MmGetSystemRoutineAddress((PUNICODE_STRING)&G_QipRoutineName); + G_Common.RtlImageDirectoryEntryToData = + (t_RtlImageDirectoryEntryToData)MmGetSystemRoutineAddress((PUNICODE_STRING)&G_IdetdRoutineName); + const STRING ciModuleName = RTL_CONSTANT_STRING("\\SystemRoot\\system32\\CI.dll"); PVOID driverBaseAddress = NULL, functionAddress = NULL; @@ -62,12 +71,7 @@ DomitoInit() G_CI.CiValidateFileObject = (t_CiValidateFileObject)functionAddress; } } - - G_Common.ZwQueryInformationProcess = - (t_ZwQueryInformationProcess)MmGetSystemRoutineAddress((PUNICODE_STRING)&G_QipRoutineName); - G_Common.RtlImageDirectoryEntryToData = - (t_RtlImageDirectoryEntryToData)MmGetSystemRoutineAddress((PUNICODE_STRING)&G_IdetdRoutineName); - + return STATUS_SUCCESS; // TODO: unused currently }