DriverMon
DriverMon copied to clipboard
Possibility to auto attach
Is this possible to auto attach as soon as the driver loads?
Currently, no. But I have an idea on how to do it...
Is there some kind of notification or it will be a constant checking?
Constant checking won't work, since you'd surely miss it. I would start with PsSetLoadImageNotifyRoutine and when the driver file in question loads prepare to hook. Although I need to think of the exact details on how to do it, since the driver file loading in this regard is perhaps a bit too early.