Once the sample is open, the first step is to track down the DriverObject, which is provided as the first argument of the main function (through the stack for 32-bit systems and through the rcx register for 64-bit systems). In this way, we can monitor whether any of the major functions are defined by malware. This object implements the _DRIVER_OBJECT structure with a list of major functions located at the end of it. The corresponding structure member is as follows:
PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
In assembly, they will likely be accessed by offsets and can be easily mapped by applying this structure.
Additionally, it is worth checking whether any completion routine is specified using the IoSetCompletionRoutine API.
Then, we need to search for the presence of instructions that allow us to disable security measures such as the previously mentioned write protection, which involves using the CR0 register. In this way, it becomes possible to easily...