#include "driver.h"
 
HANDLE sectionHandle = NULL;
PVOID pSharedMemory = NULL;
HANDLE thread_handle;
 
typedef struct _INSTRUCTIONS
{
    BOOLEAN close;
    BOOLEAN read;
    BOOLEAN reqBase;
    void* bufferAddress;
    UINT_PTR address;
    ULONGLONG size;
    void* output;
    ULONG64 baseAddress;
    const char* moduleName;
} INSTRUCTIONS;
 
NTSTATUS CreateSharedMemory()
{
    NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
    WCHAR SharedSectionName[] = L"\\BaseNamedObjects\\SharedMem";
    UNICODE_STRING uSectionName = { 0 };
    RtlInitUnicodeString(&uSectionName, SharedSectionName);
    SECURITY_DESCRIPTOR sd;
    ntStatus = RtlCreateSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
    if (!NT_SUCCESS(ntStatus))
    {
        DbgPrintEx(0, 0, "[SharedMemDriver] RtlCreateSecurityDescriptor Failed! Status: %08X\n", ntStatus);
        return ntStatus;
    }
    ntStatus = RtlSetDaclSecurityDescriptor(&sd, TRUE, NULL, FALSE);
    if (!NT_SUCCESS(ntStatus))
    {
        DbgPrintEx(0, 0, "[SharedMemDriver] RtlSetDaclSecurityDescriptor Failed! Status: %08X\n", ntStatus);
        return ntStatus;
    }
    OBJECT_ATTRIBUTES objAttributes = { 0 };
    InitializeObjectAttributes(&objAttributes, &uSectionName, OBJ_CASE_INSENSITIVE, NULL, &sd);
    LARGE_INTEGER lMaxSize = { 0 };
    lMaxSize.HighPart = 0;
    lMaxSize.LowPart = 1024 * 10;
 
    ntStatus = ZwCreateSection(&sectionHandle, SECTION_ALL_ACCESS, &objAttributes, &lMaxSize, PAGE_READWRITE, SEC_COMMIT, NULL);
    if (!NT_SUCCESS(ntStatus))
    {
        DbgPrintEx(0, 0, "[SharedMemDriver] ZwCreateSection Failed! Status: %08X\n", ntStatus);
        return ntStatus;
    }
 
    ntStatus = ZwMapViewOfSection(sectionHandle, ZwCurrentProcess(), &pSharedMemory, 0, 0, NULL, &lMaxSize, ViewShare, 0, PAGE_READWRITE);
    if (!NT_SUCCESS(ntStatus))
    {
        DbgPrintEx(0, 0, "[SharedMemDriver] ZwMapViewOfSection Failed! Status: %08X\n", ntStatus);
        ZwClose(sectionHandle);
        return ntStatus;
    }
    return STATUS_SUCCESS;
}
 
 
 
VOID MyThreadFunction(PVOID Context)
{
    CreateSharedMemory();
 
    INSTRUCTIONS* instructions = (INSTRUCTIONS*)pSharedMemory;
    while (TRUE)
    {
        while (pSharedMemory != NULL)
        {
            if (instructions->close == TRUE)
            {
                DbgPrintEx(0, 0, "Received Close Request!");
                ZwClose(pSharedMemory);
                ZwClose(sectionHandle);
                PsTerminateSystemThread(thread_handle);
            }
 
            if (instructions->reqBase == TRUE)
            {
                DbgPrintEx(0, 0, "Received ReqBase Request!");
 
                instructions->baseAddress = 0x123123; //TEST
                instructions->output = instructions->baseAddress;
            }
 
            if (instructions->read == TRUE)
            {
                DbgPrintEx(0, 0, "Received Read Request!");
                // Handle read operation
            }
        }
    }
}
 
NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
{
    UNREFERENCED_PARAMETER(DriverObject);
    UNREFERENCED_PARAMETER(RegistryPath);
 
    const auto status = PsCreateSystemThread(
        &thread_handle,
        GENERIC_ALL,
        NULL,
        NULL,
        NULL,
        MyThreadFunction,
        NULL
    );
 
    if (!NT_SUCCESS(status))
        return status;
 
    ZwClose(thread_handle);
 
    return STATUS_SUCCESS;
}

make sure to remove/avoid the io, ioctl, irp, irp major functions, systemthreads, threads and replace it with more unique ways to make this work

windows version 2004