Added .editorconfig

.editorconfig

@@ -0,0 +1,17 @@
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+charset = utf-8
+trim_trailing_whitespace = true
+end_of_line = crlf
+insert_final_newline = true
+
+# Tab indentation (no size specified)
+[Makefile]
+indent_style = tab
+
+[*.{c,h,cpp,hpp}]
+indent_style = space
+indent_size = 4

Domito.sln

@@ -5,6 +5,14 @@ VisualStudioVersion = 17.6.33723.286
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Domito", "src\Domito.vcxproj", "{949657C4-92F7-48A5-90DD-02B4709AA6BF}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{C52A96B3-00CD-40C6-8648-DE141DF2559D}"
+	ProjectSection(SolutionItems) = preProject
+		.editorconfig = .editorconfig
+		.gitignore = .gitignore
+		LICENSE = LICENSE
+		README.md = README.md
+	EndProjectSection
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM64 = Debug|ARM64

Domito.sln.DotSettings

@@ -1,3 +1,4 @@
 <wpf:ResourceDictionary xml:space="preserve" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:s="clr-namespace:System;assembly=mscorlib" xmlns:ss="urn:shemas-jetbrains-com:settings-storage-xaml" xmlns:wpf="http://schemas.microsoft.com/winfx/2006/xaml/presentation">
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=Domito/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=PDOMITO/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=PSYSTEM/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>

include/Domito.h

@@ -3,63 +3,75 @@
 // Structure representing a loaded module
 typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY
 {
-    PVOID Unknown1;
+	PVOID Unknown1;
-    PVOID Unknown2;
+	PVOID Unknown2;
-    PVOID Base;
+	PVOID Base;
-    ULONG Size;
+	ULONG Size;
-    ULONG Flags;
+	ULONG Flags;
-    USHORT Index;
+	USHORT Index;
-    USHORT NameLength;
+	USHORT NameLength;
-    USHORT LoadCount;
+	USHORT LoadCount;
-    USHORT PathLength;
+	USHORT PathLength;
-    CHAR ImageName[256];
+	CHAR ImageName[256];
-} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
+} SYSTEM_MODULE_INFORMATION_ENTRY, * PSYSTEM_MODULE_INFORMATION_ENTRY;
 
 // Structure representing the loaded module information
 typedef struct _SYSTEM_MODULE_INFORMATION
 {
-    ULONG Count;
+	ULONG Count;
-    SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
+	SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
-} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
+} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
 
 // Function prototype for ZwQuerySystemInformation
 NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation(
-    ULONG SystemInformationClass,
+	ULONG SystemInformationClass,
-    PVOID SystemInformation,
+	PVOID SystemInformation,
-    ULONG SystemInformationLength,
+	ULONG SystemInformationLength,
-    PULONG ReturnLength
+	PULONG ReturnLength
 );
 
 typedef struct _LDR_DATA_TABLE_ENTRY
 {
-    LIST_ENTRY64 InLoadOrderLinks;
+	LIST_ENTRY64 InLoadOrderLinks;
-    PVOID ExceptionTable;
+	PVOID ExceptionTable;
-    ULONG ExceptionTableSize;
+	ULONG ExceptionTableSize;
-    PVOID GpValue;
+	PVOID GpValue;
-    PVOID NonPagedDebugInfo;
+	PVOID NonPagedDebugInfo;
-    PVOID ImageBase;
+	PVOID ImageBase;
-    PVOID EntryPoint;
+	PVOID EntryPoint;
-    ULONG SizeOfImage;
+	ULONG SizeOfImage;
-    UNICODE_STRING FullImageName;
+	UNICODE_STRING FullImageName;
-    UNICODE_STRING BaseImageName;
+	UNICODE_STRING BaseImageName;
-    ULONG Flags;
+	ULONG Flags;
-    USHORT LoadCount;
+	USHORT LoadCount;
-    USHORT TlsIndex;
+	USHORT TlsIndex;
-    LIST_ENTRY64 HashLinks;
+	LIST_ENTRY64 HashLinks;
-    PVOID SectionPointer;
+	PVOID SectionPointer;
-    ULONG CheckSum;
+	ULONG CheckSum;
-    ULONG TimeDateStamp;
+	ULONG TimeDateStamp;
-    PVOID LoadedImports;
+	PVOID LoadedImports;
-    PVOID EntryPointActivationContext;
+	PVOID EntryPointActivationContext;
-    PVOID PatchInformation;
+	PVOID PatchInformation;
-} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
+} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
 
-typedef PVOID (NTAPI* t_RtlImageDirectoryEntryToData)(
+typedef PVOID(NTAPI* t_RtlImageDirectoryEntryToData)(
-    IN PVOID Base,
+	IN PVOID Base,
-    IN BOOLEAN MappedAsImage,
+	IN BOOLEAN MappedAsImage,
-    IN USHORT DirectoryEntry,
+	IN USHORT DirectoryEntry,
-    OUT PULONG Size
+	OUT PULONG Size
+	);
+
+
+typedef
+_IRQL_requires_same_
+_Function_class_(DOMITO_ALLOCATE_ROUTINE)
+__drv_allocatesMem(Mem)
+PVOID
+NTAPI
+DOMITO_ALLOCATE_ROUTINE(
+	_In_ SIZE_T ByteSize
 );
+typedef DOMITO_ALLOCATE_ROUTINE* PDOMITO_ALLOCATE_ROUTINE;
 
 
 _Success_(return == STATUS_SUCCESS)
@@ -68,8 +80,8 @@ _IRQL_requires_max_(PASSIVE_LEVEL)
 EXTERN_C
 NTSTATUS
 DomitoFindDriverBaseAddress(
-    _In_ STRING ModuleName,
+	_In_ STRING ModuleName,
-    _Inout_opt_ PVOID* ModuleBase
+	_Inout_opt_ PVOID * ModuleBase
 );
 
 _Success_(return == STATUS_SUCCESS)
@@ -78,7 +90,7 @@ _IRQL_requires_max_(PASSIVE_LEVEL)
 EXTERN_C
 NTSTATUS
 DomitoFindExportedFunctionAddress(
-    _In_ PVOID ModuleBase,
+	_In_ PVOID ModuleBase,
-    _In_ STRING FunctionName,
+	_In_ STRING FunctionName,
-    _Inout_opt_ PVOID* FunctionAddress
+	_Inout_opt_ PVOID * FunctionAddress
 );