#include <ntifs.h>
#include <ntddk.h>

// ==========================================================
// Definitions and Macros
// ==========================================================

#define TARGET_PROCESS_NAME L"notepad.exe" // Replace with your target process name
#define MY_WNF_STATE_NAME 0x41C64E6DA3BC1074ULL // Example WNF State Name (WNF_AUDC_CAPTURE)

// Windows Build Numbers
#define WINDOWS_1803 17134
#define WINDOWS_1809 17763
#define WINDOWS_1903 18362
#define WINDOWS_1909 18363
#define WINDOWS_2004 19041
#define WINDOWS_20H2 19042
#define WINDOWS_21H1 19043
#define WINDOWS_22H2 19044

// Page size definitions
#define PAGE_OFFSET_SIZE 12
#define PAGE_SIZE 0x1000
#define PMASK (~0xFFFULL)

// Custom type definitions
using QWORD = unsigned __int64;

// ==========================================================
// Function Pointer Types for WNF (Undocumented APIs)
// ==========================================================

using EXSUBSCRIBEWNFSTATECHANGE = NTSTATUS()(PVOID Subscription,
    ULONG64 StateName,
    ULONG ChangeStamp,
    PVOID Callback,
    PVOID CallbackContext,
    PVOID TypeId,
    ULONG SerializationGroup,
    ULONG Unknown
    );

using EXPUBLISHWNFSTATEDATA = NTSTATUS()(ULONG64 StateName,
    PVOID Buffer,
    ULONG Length,
    PVOID TypeId,
    PVOID ExplicitScope,
    ULONG MatchingChangeStamp
    );

using EXUNSUBSCRIBEWNFSTATECHANGE = NTSTATUS()(PVOID Subscription);

// ==========================================================
// Global Function Pointers for WNF
// ==========================================================

EXSUBSCRIBEWNFSTATECHANGE ExSubscribeWnfStateChange = nullptr;
EXPUBLISHWNFSTATEDATA ExPublishWnfStateData = nullptr;
EXUNSUBSCRIBEWNFSTATECHANGE ExUnsubscribeWnfStateChange = nullptr;

ULONG64 MY_WNF_STATE_NAME_VALUE = MY_WNF_STATE_NAME; // Ensure consistency

PVOID g_WnfSubscription = nullptr; // Global WNF subscription handle

// ==========================================================
// Structures
// ==========================================================

#pragma pack(push, 1)
struct INSTRUCTIONS {
    BYTE close;              // Flag to close subscription
    BYTE read;               // Flag to perform read operation
    BYTE write;              // Flag to perform write operation
    BYTE reqBase;            // Flag to request base address
    UINT64 processId;        // Target process ID
    UINT64 address;          // Target virtual address
    UINT64 size;             // Size of read/write
    PVOID bufferAddress;     // Buffer address in user-mode
    PVOID output;            // Output buffer (for read operations)
    UINT64 baseAddress;      // Base address (for base address requests)
    CHAR moduleName[256];    // Module name (if needed)
    BYTE data[1024];         // Data buffer for read/write
};
#pragma pack(pop)

using PINSTRUCTIONS = INSTRUCTIONS;

// ==========================================================
// Function Declarations
// ==========================================================

// Physical Memory Access Functions
NTSTATUS ReadPhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T BytesRead);
NTSTATUS WritePhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T* BytesWritten);
DWORD GetUserDirectoryTableBaseOffset();
ULONG_PTR GetProcessCr3(PEPROCESS pProcess);
uint64_t TranslateLinearAddress(uint64_t directoryTableBase, uint64_t virtualAddress);

// Memory Operations
NTSTATUS ReadVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T* bytesRead);
NTSTATUS WriteVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T* bytesWritten);

// Process Memory Operations
NTSTATUS ReadProcessMemoryInternal(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T* BytesRead);
NTSTATUS WriteProcessMemoryInternal(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T* BytesWritten);

// WNF Communication
NTSTATUS OnWnfCallback(
    PVOID Subscription,
    ULONG64 StateName,
    ULONG ChangeStamp,
    PVOID TypeId,
    PVOID CallbackContext,
    PVOID Buffer,
    ULONG BufferSize
);
NTSTATUS SubscribeToWNF();

// Base64 Encoding/Decoding
UCHAR Base64DecodeChar(char c);
NTSTATUS DecodeBase64(const CHAR* base64Input, UCHAR* outputBuffer, SIZE_T bufferSize, SIZE_T* decodedSize);
NTSTATUS EncodeBase64(const UCHAR* input, SIZE_T inputSize, CHAR* outputBuffer, SIZE_T bufferSize, SIZE_T* encodedSize);

// Process Notification
VOID ProcessNotifyCallback(
    __in HANDLE ParentId,
    __in HANDLE ProcessId,
    __in BOOLEAN Create
);

// Driver Unload
VOID DriverUnloadRoutine(PDRIVER_OBJECT DriverObject);

// Driver Entry
NTSTATUS DriverEntryRoutine(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);

// Helper Functions
PVOID GetProcessBaseAddress(HANDLE pid);

// ==========================================================
// Function Definitions
// ==========================================================

// Get the offset for UserDirectoryTableBase based on Windows version
DWORD GetUserDirectoryTableBaseOffset()
{
    RTL_OSVERSIONINFOW ver = { 0 };
    RtlGetVersion(&ver);
    switch (ver.dwBuildNumber)
    {
    case WINDOWS_1803:
    case WINDOWS_1809:
        return 0x0278;
    case WINDOWS_1903:
    case WINDOWS_1909:
        return 0x0280;
    case WINDOWS_2004:
    case WINDOWS_20H2:
    case WINDOWS_21H1:
    case WINDOWS_22H2:
    default:
        return 0x0388;
    }
}

// Read physical memory
NTSTATUS ReadPhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T BytesRead)
{
    if (!TargetAddress || !lpBuffer || !BytesRead)
        return STATUS_INVALID_PARAMETER;

    MM_COPY_ADDRESS AddrToRead = { 0 };
    AddrToRead.PhysicalAddress.QuadPart = reinterpret_cast<ULONGLONG>(TargetAddress);

    NTSTATUS status = MmCopyMemory(lpBuffer, AddrToRead, Size, MM_COPY_MEMORY_PHYSICAL, BytesRead);
    return status;
}

// Write physical memory
NTSTATUS WritePhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T* BytesWritten)
{
    if (!TargetAddress || !lpBuffer || !BytesWritten)
        return STATUS_INVALID_PARAMETER;

    PHYSICAL_ADDRESS AddrToWrite;
    AddrToWrite.QuadPart = reinterpret_cast<ULONGLONG>(TargetAddress);

    PVOID pmapped_mem = MmMapIoSpaceEx(AddrToWrite, Size, PAGE_READWRITE);
    if (!pmapped_mem)
        return STATUS_UNSUCCESSFUL;

    RtlCopyMemory(pmapped_mem, lpBuffer, Size);
    BytesWritten = Size;
    MmUnmapIoSpace(pmapped_mem, Size);
    return STATUS_SUCCESS;
}

// Retrieve the CR3 (Page Directory Base) of a process
ULONG_PTR GetProcessCr3(PEPROCESS pProcess)
{
    PUCHAR process = reinterpret_cast<PUCHAR>(pProcess);
#ifdef _WIN64
    ULONG_PTR process_dirbase_ptr = reinterpret_cast<ULONG_PTR*>(process + 0x28); // dirbase for x64
#else
    ULONG_PTR* process_dirbase_ptr = reinterpret_cast<ULONG_PTR*>(process + 0x18); // dirbase for x86
#endif
    ULONG_PTR process_dirbase = process_dirbase_ptr;

    if (process_dirbase == 0)
    {
        DWORD UserDirOffset = GetUserDirectoryTableBaseOffset();
        ULONG_PTR process_userdirbase = reinterpret_cast<ULONG_PTR>(process + UserDirOffset);
        return process_userdirbase;
    }
    return process_dirbase;
}

// Translate a virtual address to a physical address using the provided directory table base
uint64_t TranslateLinearAddress(uint64_t directoryTableBase, uint64_t virtualAddress)
{
    directoryTableBase &= PMASK; // Align directoryTableBase

    uint64_t pageOffset = virtualAddress & 0xFFFULL;
    uint64_t pteIndex = (virtualAddress >> 12) & 0x1FFULL;
    uint64_t ptIndex = (virtualAddress >> 21) & 0x1FFULL;
    uint64_t pdIndex = (virtualAddress >> 30) & 0x1FFULL;
    uint64_t pdpIndex = (virtualAddress >> 39) & 0x1FFULL;

    SIZE_T readsize = 0;
    uint64_t pdpe = 0;

    // Read PDPE
    NTSTATUS status = ReadPhysicalAddress(reinterpret_cast<PVOID>(directoryTableBase + 8 * pdpIndex), &pdpe, sizeof(pdpe), readsize);
    if (!NT_SUCCESS(status) || !(pdpe & 1))
        return 0;

    // Read PDE
    uint64_t pde = 0;
    status = ReadPhysicalAddress(reinterpret_cast<PVOID>((pdpe & PMASK) + 8 * pdIndex), &pde, sizeof(pde), readsize);
    if (!NT_SUCCESS(status) || !(pde & 1))
        return 0;

    // 1GB large page
    if (pde & (1 << 7)) // PS bit
        return (pde & 0xFFFFFC0000000ULL) + (virtualAddress & 0x3FFFFFFFULL);

    // Read PTE
    uint64_t pteAddr = 0;
    status = ReadPhysicalAddress(reinterpret_cast<PVOID>((pde & PMASK) + 8 * ptIndex), &pteAddr, sizeof(pteAddr), readsize);
    if (!NT_SUCCESS(status) || !(pteAddr & 1))
        return 0;

    // 2MB large page
    if (pteAddr & (1 << 7)) // PS bit
        return (pteAddr & PMASK) + (virtualAddress & 0x1FFFFFULL);

    // Read Page Table Entry
    uint64_t pageTableEntry = 0;
    status = ReadPhysicalAddress(reinterpret_cast<PVOID>((pteAddr & PMASK) + 8 * pteIndex), &pageTableEntry, sizeof(pageTableEntry), readsize);
    if (!NT_SUCCESS(status) || !(pageTableEntry & 1))
        return 0;

    uint64_t physAddress = (pageTableEntry & PMASK) + pageOffset;
    return physAddress;
}

// Read virtual memory using physical address translation
NTSTATUS ReadVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T bytesRead)
{
    if (!buffer || !bytesRead)
        return STATUS_INVALID_PARAMETER;

    SIZE_T totalBytesRead = 0;
    SIZE_T bytesToRead = size;
    NTSTATUS status = STATUS_SUCCESS;

    while (bytesToRead > 0)
    {
        uint64_t physAddress = TranslateLinearAddress(directoryTableBase, virtualAddress);
        if (!physAddress)
        {
            status = STATUS_UNSUCCESSFUL;
            break;
        }

        ULONG64 readSize = min(PAGE_SIZE - (physAddress & 0xFFFULL), bytesToRead);
        SIZE_T localBytesRead = 0;
        status = ReadPhysicalAddress(reinterpret_cast<PVOID>(physAddress), reinterpret_cast<PVOID>((ULONG_PTR)buffer + totalBytesRead), readSize, localBytesRead);
        if (!NT_SUCCESS(status) || localBytesRead == 0)
            break;

        bytesToRead -= localBytesRead;
        virtualAddress += localBytesRead;
        totalBytesRead += localBytesRead;
    }

    if (bytesRead)
        bytesRead = totalBytesRead;
    return status;
}

// Write virtual memory using physical address translation
NTSTATUS WriteVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T bytesWritten)
{
    if (!buffer || !bytesWritten)
        return STATUS_INVALID_PARAMETER;

    SIZE_T totalBytesWritten = 0;
    SIZE_T bytesToWrite = size;
    NTSTATUS status = STATUS_SUCCESS;

    while (bytesToWrite > 0)
    {
        uint64_t physAddress = TranslateLinearAddress(directoryTableBase, virtualAddress);
        if (!physAddress)
        {
            status = STATUS_UNSUCCESSFUL;
            break;
        }

        ULONG64 writeSize = min(PAGE_SIZE - (physAddress & 0xFFFULL), bytesToWrite);
        SIZE_T localBytesWritten = 0;
        status = WritePhysicalAddress(reinterpret_cast<PVOID>(physAddress), reinterpret_cast<PVOID>((ULONG_PTR)buffer + totalBytesWritten), writeSize, &localBytesWritten);
        if (!NT_SUCCESS(status) || localBytesWritten == 0)
            break;

        bytesToWrite -= localBytesWritten;
        virtualAddress += localBytesWritten;
        totalBytesWritten += localBytesWritten;
    }

    if (bytesWritten)
        bytesWritten = totalBytesWritten;
    return status;
}

// Internal ReadProcessMemory function
NTSTATUS ReadProcessMemoryInternal(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T BytesRead)
{
    if (pid == NULL || Address == NULL || Buffer == NULL || BytesRead == NULL)
        return STATUS_INVALID_PARAMETER;

    PEPROCESS pProcess = NULL;
    NTSTATUS status = PsLookupProcessByProcessId(pid, &pProcess);
    if (!NT_SUCCESS(status))
        return status;

    ULONG_PTR dirBase = GetProcessCr3(pProcess);
    ObDereferenceObject(pProcess);

    return ReadVirtualMemory(dirBase, reinterpret_cast<ULONG_PTR>(Address), Buffer, Size, BytesRead);
}

// Internal WriteProcessMemory function
NTSTATUS WriteProcessMemoryInternal(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T* BytesWritten)
{
    if (pid == NULL || Address == NULL || Buffer == NULL || BytesWritten == NULL)
        return STATUS_INVALID_PARAMETER;

    PEPROCESS pProcess = NULL;
    NTSTATUS status = PsLookupProcessByProcessId(pid, &pProcess);
    if (!NT_SUCCESS(status))
        return status;

    ULONG_PTR dirBase = GetProcessCr3(pProcess);
    ObDereferenceObject(pProcess);

    return WriteVirtualMemory(dirBase, reinterpret_cast<ULONG_PTR>(Address), Buffer, Size, BytesWritten);
}

// Base64 Decode a single character
UCHAR Base64DecodeChar(char c)
{
    if (c >= 'A' && c <= 'Z') return static_cast<UCHAR>(c - 'A');
    if (c >= 'a' && c <= 'z') return static_cast<UCHAR>(c - 'a' + 26);
    if (c >= '0' && c <= '9') return static_cast<UCHAR>(c - '0' + 52);
    if (c == '+') return 62;
    if (c == '/') return 63;
    return 0xFF; // Invalid character
}

// Decode Base64 string to binary
NTSTATUS DecodeBase64(const CHAR* base64Input, UCHAR* outputBuffer, SIZE_T bufferSize, SIZE_T* decodedSize)
{
    if (!base64Input || !outputBuffer || !decodedSize)
        return STATUS_INVALID_PARAMETER;

    SIZE_T inputLen = strlen(base64Input);
    if (inputLen % 4 != 0)
        return STATUS_INVALID_PARAMETER;

    SIZE_T outputLen = (inputLen / 4) * 3;
    if (outputLen > bufferSize)
        return STATUS_BUFFER_TOO_SMALL;

    decodedSize = 0;

    for (SIZE_T i = 0; i < inputLen; i += 4)
    {
        UCHAR sextet_a = Base64DecodeChar(base64Input[i]);
        UCHAR sextet_b = Base64DecodeChar(base64Input[i + 1]);
        UCHAR sextet_c = Base64DecodeChar(base64Input[i + 2]);
        UCHAR sextet_d = Base64DecodeChar(base64Input[i + 3]);

        if (sextet_a == 0xFF || sextet_b == 0xFF)
            return STATUS_INVALID_PARAMETER;

        UCHAR triple[3] = { 0 };

        triple[0] = (sextet_a << 2) | (sextet_b >> 4);
        if (base64Input[i + 2] != '=')
        {
            if (sextet_c == 0xFF)
                return STATUS_INVALID_PARAMETER;
            triple[1] = ((sextet_b & 0xF) << 4) | (sextet_c >> 2);
        }
        if (base64Input[i + 3] != '=')
        {
            if (sextet_d == 0xFF)
                return STATUS_INVALID_PARAMETER;
            triple[2] = ((sextet_c & 0x3) << 6) | sextet_d;
        }

        // Copy the decoded bytes to the output buffer
        outputBuffer[decodedSize] = triple[0];
        (decodedSize)++;

        if (base64Input[i + 2] != '=')
        {
            outputBuffer[decodedSize] = triple[1];
            (decodedSize)++;
        }

        if (base64Input[i + 3] != '=')
        {
            outputBuffer[decodedSize] = triple[2];
            (decodedSize)++;
        }
    }

    return STATUS_SUCCESS;
}

// Base64 Encode binary data to string
NTSTATUS EncodeBase64(const UCHAR input, SIZE_T inputSize, CHAR outputBuffer, SIZE_T bufferSize, SIZE_T encodedSize)
{
    if (!input || !outputBuffer || !encodedSize)
        return STATUS_INVALID_PARAMETER;

    const char base64_table[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    SIZE_T outputNeeded = ((inputSize + 2) / 3) * 4;
    if (outputNeeded + 1 > bufferSize) // +1 for null terminator
        return STATUS_BUFFER_TOO_SMALL;

    encodedSize = 0;

    for (SIZE_T i = 0; i < inputSize; i += 3)
    {
        UCHAR a = input[i];
        UCHAR b = (i + 1 < inputSize) ? input[i + 1] : 0;
        UCHAR c = (i + 2 < inputSize) ? input[i + 2] : 0;

        outputBuffer[encodedSize] = base64_table[(a >> 2) & 0x3F];
        (encodedSize)++;
        outputBuffer[encodedSize] = base64_table[((a & 0x3) << 4) | ((b & 0xF0) >> 4)];
        (encodedSize)++;
        outputBuffer[encodedSize] = (i + 1 < inputSize) ? base64_table[((b & 0xF) << 2) | ((c & 0xC0) >> 6)] : '=';
        (encodedSize)++;
        outputBuffer[encodedSize] = (i + 2 < inputSize) ? base64_table[c & 0x3F] : '=';
        (encodedSize)++;
    }

    // Null-terminate the output
    if (encodedSize < bufferSize)
    {
        outputBuffer[encodedSize] = '\0';
    }
    else
    {
        outputBuffer[bufferSize - 1] = '\0'; // Ensure null termination
    }

    return STATUS_SUCCESS;
}

// Retrieve the base address of a process given its PID
PVOID GetProcessBaseAddress(HANDLE pid)
{
    if (pid == NULL)
        return nullptr;

    PEPROCESS pProcess = nullptr;
    NTSTATUS status = PsLookupProcessByProcessId(pid, &pProcess);
    if (!NT_SUCCESS(status))
        return nullptr;

    PVOID Base = PsGetProcessSectionBaseAddress(pProcess);
    ObDereferenceObject(pProcess);
    return Base;
}

// Read process memory
NTSTATUS ReadProcessMemoryInternal(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T BytesRead)
{
    if (pid == NULL || Address == NULL || Buffer == NULL || BytesRead == NULL)
        return STATUS_INVALID_PARAMETER;

    return ReadProcessMemoryInternal(pid, Address, Buffer, Size, BytesRead);
}

// Write process memory
NTSTATUS WriteProcessMemoryInternal(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T BytesWritten)
{
    if (pid == NULL || Address == NULL || Buffer == NULL || BytesWritten == NULL)
        return STATUS_INVALID_PARAMETER;

    return WriteProcessMemoryInternal(pid, Address, Buffer, Size, BytesWritten);
}

// ==========================================================
// WNF Callback Function
// ==========================================================

NTSTATUS OnWnfCallback(
    PVOID Subscription,
    ULONG64 StateName,
    ULONG ChangeStamp,
    PVOID TypeId,
    PVOID CallbackContext,
    PVOID Buffer,
    ULONG BufferSize
)
{
    UNREFERENCED_PARAMETER(Subscription);
    UNREFERENCED_PARAMETER(StateName);
    UNREFERENCED_PARAMETER(ChangeStamp);
    UNREFERENCED_PARAMETER(TypeId);
    UNREFERENCED_PARAMETER(CallbackContext);

    NTSTATUS status = STATUS_SUCCESS;

    if (Buffer && BufferSize >= sizeof(INSTRUCTIONS))
    {
        PINSTRUCTIONS instructions = static_cast<PINSTRUCTIONS>(Buffer);

        if (instructions->read)
        {
            // Handle read request
            SIZE_T bytesRead = 0;
            BYTE readBuffer[1024] = { 0 };

            status = ReadProcessMemoryInternal(
                reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)),
                reinterpret_cast<PVOID>(static_cast<ULONGLONG>(instructions->address)),
                readBuffer,
                static_cast<SIZE_T>(instructions->size),
                &bytesRead
            );

            if (NT_SUCCESS(status))
            {
                // Encode the read data to Base64
                SIZE_T base64Size = ((bytesRead + 2) / 3) * 4;
                if (base64Size + 1 > sizeof(instructions->data))
                {
                    DbgPrint("[Driver] Read operation failed: Encoded data exceeds buffer size.\n");
                    status = ExPublishWnfStateData(
                        MY_WNF_STATE_NAME_VALUE,
                        "Read operation failed: Encoded data exceeds buffer size.",
                        static_cast<ULONG>(strlen("Read operation failed: Encoded data exceeds buffer size.") + 1),
                        nullptr,
                        nullptr,
                        0
                    );
                    return status;
                }

                CHAR encodedData[4096] = { 0 };
                SIZE_T encodedLength = 0;
                status = EncodeBase64(readBuffer, bytesRead, encodedData, sizeof(encodedData), &encodedLength);
                if (!NT_SUCCESS(status))
                {
                    DbgPrint("[Driver] EncodeBase64 failed with status: 0x%X\n", status);
                    status = ExPublishWnfStateData(
                        MY_WNF_STATE_NAME_VALUE,
                        "Read operation failed: Base64 encode failed.",
                        static_cast<ULONG>(strlen("Read operation failed: Base64 encode failed.") + 1),
                        nullptr,
                        nullptr,
                        0
                    );
                    return status;
                }

                // Prepare instructions to send back
                RtlZeroMemory(instructions->data, sizeof(instructions->data));
                RtlCopyMemory(instructions->data, encodedData, min(encodedLength, sizeof(instructions->data) - 1));
                instructions->size = bytesRead;

                // Publish the data back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                if (NT_SUCCESS(status))
                {
                    DbgPrint("[Driver] Read operation completed successfully. %zu bytes read, %zu bytes encoded.\n", bytesRead, encodedLength);
                }
                else
                {
                    DbgPrint("[Driver] ExPublishWnfStateData failed with status: 0x%X\n", status);
                }
            }
            else
            {
                // Handle read error
                DbgPrint("[Driver] ReadProcessMemoryInternal failed with status: 0x%X\n", status);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Read operation failed.",
                    static_cast<ULONG>(strlen("Read operation failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        else if (instructions->write)
        {
            // Handle write request
            SIZE_T bytesWritten = 0;

            // Decode Base64 data
            UCHAR decodedData[512] = { 0 };
            SIZE_T decodedSize = 0;
            status = DecodeBase64(reinterpret_cast<CHAR>(instructions->data), decodedData, sizeof(decodedData), &decodedSize);
            if (!NT_SUCCESS(status))
            {
                DbgPrint("[Driver] DecodeBase64 failed with status: 0x%X\n", status);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Write operation failed: Base64 decode failed.",
                    static_cast<ULONG>(strlen("Write operation failed: Base64 decode failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
                return status;
            }

            status = WriteProcessMemoryInternal(
                reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)),
                reinterpret_cast<PVOID>(static_cast<ULONGLONG>(instructions->address)),
                decodedData,
                decodedSize,
                &bytesWritten
            );

            if (NT_SUCCESS(status) && bytesWritten == decodedSize)
            {
                // Prepare instruction to send back
                instructions->size = bytesWritten;

                // Publish the success message back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                DbgPrint("[Driver] Write operation completed successfully. %zu bytes written to process %llu at address 0x%llX.\n",
                    bytesWritten, instructions->processId, instructions->address);
            }
            else
            {
                // Handle write error
                DbgPrint("[Driver] WriteProcessMemoryInternal failed with status: 0x%X and bytes written: %zu\n", status, bytesWritten);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Write operation failed.",
                    static_cast<ULONG>(strlen("Write operation failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        else if (instructions->close)
        {
            // Handle close instruction
            // Currently, no specific cleanup is required
            DbgPrint("[Driver] Received close instruction.\n");
        }
        else if (instructions->reqBase)
        {
            // Handle base address request
            PEPROCESS pProcess = nullptr;
            NTSTATUS statusLookup = PsLookupProcessByProcessId(reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)), &pProcess);
            if (NT_SUCCESS(statusLookup))
            {
                PVOID baseAddress = PsGetProcessSectionBaseAddress(pProcess);
                instructions->baseAddress = reinterpret_cast<UINT64>(baseAddress);
                ObDereferenceObject(pProcess);

                // Publish the base address back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                DbgPrint("[Driver] Base address of process %llu: %p\n", instructions->processId, baseAddress);
            }
            else
            {
                // Handle error
                DbgPrint("[Driver] PsLookupProcessByProcessId failed with status: 0x%X\n", statusLookup);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Base address request failed: PsLookupProcessByProcessId failed.",
                    static_cast<ULONG>(strlen("Base address request failed: PsLookupProcessByProcessId failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        // Additional instruction handling can be added here
    }
    else if (Buffer && BufferSize > 0)
    {
        // Handle simple messages like "Hi"
        CHAR receivedMessage = static_cast<CHAR>(ExAllocatePoolWithTag(NonPagedPoolNx, BufferSize + 1, 'msgK'));
        if (!receivedMessage)
        {
            DbgPrint("[Driver] Failed to allocate memory for received message.\n");
            return STATUS_INSUFFICIENT_RESOURCES;
        }

        RtlZeroMemory(receivedMessage, BufferSize + 1);
        RtlCopyMemory(receivedMessage, Buffer, min(static_cast<SIZE_T>(BufferSize), static_cast<SIZE_T>(sizeof(CHAR) * (BufferSize))));

        DbgPrint("[Driver] Kernel received message: %s\n", receivedMessage);

        if (strcmp(receivedMessage, "Hi") == 0)
        {
            // Send handshake response
            const CHAR responseMessage = "Hello from kernel mode";
            status = ExPublishWnfStateData(
                MY_WNF_STATE_NAME_VALUE,
                const_cast<CHAR>(responseMessage),
                static_cast<ULONG>(strlen(responseMessage) + 1),
                nullptr,
                nullptr,
                0
            );

            if (NT_SUCCESS(status))
            {
                DbgPrint("[Driver] Handshake response sent successfully.\n");
            }
            else
            {
                DbgPrint("[Driver] Failed to send handshake response with status: 0x%X\n", status);
            }
        }

        ExFreePoolWithTag(receivedMessage, 'msgK');
    }
    else
    {
        // Handle unexpected or unsupported data
        DbgPrint("[Driver] Received invalid or unsupported data.\n");
    }

    return status;
}

// ==========================================================
// WNF Subscription Function
// ==========================================================

// Subscribe to WNF state changes
NTSTATUS SubscribeToWNF()
{
    if (!ExSubscribeWnfStateChange || !ExPublishWnfStateData || !ExUnsubscribeWnfStateChange)
    {
        DbgPrint("[Driver] WNF function pointers not initialized.\n");
        return STATUS_UNSUCCESSFUL;
    }

    NTSTATUS status = ExSubscribeWnfStateChange(
        g_WnfSubscription,
        MY_WNF_STATE_NAME_VALUE,
        0, // ChangeStamp (0 for all changes)
        reinterpret_cast<PVOID>(OnWnfCallback),
        nullptr, // CallbackContext
        nullptr, // TypeId
        0,    // SerializationGroup
        0     // Unknown
    );

    if (NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Successfully subscribed to WNF state changes.\n");
    }
    else
    {
        DbgPrint("[Driver] ExSubscribeWnfStateChange failed with status: 0x%X\n", status);
    }

    return status;
}

// ==========================================================
// Process Notification Callback
// ==========================================================

VOID ProcessNotifyCallback(
    __in HANDLE ParentId,
    __in HANDLE ProcessId,
    __in BOOLEAN Create
)
{
    UNREFERENCED_PARAMETER(ParentId);

    if (Create)
    {
        PEPROCESS pProcess = nullptr;
        NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &pProcess);
        if (NT_SUCCESS(status))
        {
            // Get process image file name
            UNICODE_STRING uProcessImageName = { 0 };
            status = SeLocateProcessImageName(pProcess, &uProcessImageName);
            if (NT_SUCCESS(status))
            {
                // Extract file name from full path
                PWSTR processName = wcsrchr(uProcessImageName.Buffer, L'\'); // Corrected backslash
                    if (processName)
                    {
                        processName++; // Move past the backslash

                        // Check if this is the target process
                        if (_wcsicmp(processName, TARGET_PROCESS_NAME) == 0)
                        {
                            // Perform memory operations here (if needed)
                            PVOID baseAddress = GetProcessBaseAddress(ProcessId);
                            if (baseAddress)
                            {
                                DbgPrint("[Driver] Target process '%ws' created with base address: %p\n", processName, baseAddress);

                                // Example: Read some memory from the process
                                BYTE buffer[256] = { 0 };
                                SIZE_T bytesRead = 0;
                                NTSTATUS ntStatus = ReadProcessMemoryInternal(
                                    reinterpret_cast<HANDLE>(ProcessId),
                                    baseAddress,
                                    buffer,
                                    sizeof(buffer),
                                    &bytesRead
                                );

                                if (NT_SUCCESS(ntStatus))
                                {
                                    DbgPrint("[Driver] Successfully read %zu bytes from '%ws'.\n", bytesRead, processName);
                                }
                                else
                                {
                                    DbgPrint("[Driver] Failed to read memory of '%ws' with status: 0x%X\n", processName, ntStatus);
                                }

                                // Example: Write to process memory (commented out for safety)
                                /
                                    BYTE writeData[256] = { / Your data here * / };
                                SIZE_T bytesWritten = 0;
                                ntStatus = WriteProcessMemoryInternal(
                                    reinterpret_cast<HANDLE>(ProcessId),
                                    baseAddress,
                                    writeData,
                                    sizeof(writeData),
                                    &bytesWritten
                                );

                                if (NT_SUCCESS(ntStatus))
                                {
                                    DbgPrint("[Driver] Successfully wrote %zu bytes to '%ws'.\n", bytesWritten, processName);
                                }
                                else
                                {
                                    DbgPrint("[Driver] Failed to write memory of '%ws' with status: 0x%X\n", processName, ntStatus);
                                }
                                /
                            }
                            else
                            {
                                DbgPrint("[Driver] Failed to retrieve base address of process ID: %llu\n", ProcessId);
                            }
                        }
                    }
                    else
                    {
                        DbgPrint("[Driver] Failed to parse process name for PID: %llu\n", ProcessId);
                    }

                // Free the allocated image name buffer
                ExFreePoolWithTag(uProcessImageName.Buffer, 'imgN');
            }
            else
            {
                DbgPrint("[Driver] SeLocateProcessImageName failed with status: 0x%X for PID: %llu\n", status, ProcessId);
            }

            ObDereferenceObject(pProcess);
        }
        else
        {
            DbgPrint("[Driver] PsLookupProcessByProcessId failed with status: 0x%X for PID: %llu\n", status, ProcessId);
        }
    }
}

// ==========================================================
// Driver Unload Routine
// ==========================================================

VOID DriverUnloadRoutine(PDRIVER_OBJECT DriverObject)
{
    UNREFERENCED_PARAMETER(DriverObject);

    // Unsubscribe from WNF
    if (g_WnfSubscription && ExUnsubscribeWnfStateChange)
    {
        NTSTATUS status = ExUnsubscribeWnfStateChange(g_WnfSubscription);
        if (NT_SUCCESS(status))
        {
            DbgPrint("[Driver] Successfully unsubscribed from WNF state changes.\n");
        }
        else
        {
            DbgPrint("[Driver] ExUnsubscribeWnfStateChange failed with status: 0x%X\n", status);
        }
        g_WnfSubscription = nullptr;
    }

    // Remove the process notify routine
    NTSTATUS status = PsSetCreateProcessNotifyRoutine(ProcessNotifyCallback, TRUE);
    if (NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Successfully removed process notify routine.\n");
    }
    else
    {
        DbgPrint("[Driver] PsSetCreateProcessNotifyRoutine removal failed with status: 0x%X\n", status);
    }

    DbgPrint("[Driver] Driver unloaded.\n");
}

// ==========================================================
// Driver Entry Function
// ==========================================================

NTSTATUS DriverEntryRoutine(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    UNREFERENCED_PARAMETER(RegistryPath);

    NTSTATUS status;

    // Resolve WNF functions
    UNICODE_STRING routineName;
    RtlInitUnicodeString(&routineName, L"ExSubscribeWnfStateChange");
    ExSubscribeWnfStateChange = reinterpret_cast<EXSUBSCRIBEWNFSTATECHANGE>(MmGetSystemRoutineAddress(&routineName));
    if (!ExSubscribeWnfStateChange)
    {
        DbgPrint("[Driver] ExSubscribeWnfStateChange not found.\n");
        return STATUS_UNSUCCESSFUL;
    }

    RtlInitUnicodeString(&routineName, L"ExPublishWnfStateData");
    ExPublishWnfStateData = reinterpret_cast<EXPUBLISHWNFSTATEDATA>(MmGetSystemRoutineAddress(&routineName));
    if (!ExPublishWnfStateData)
    {
        DbgPrint("[Driver] ExPublishWnfStateData not found.\n");
        return STATUS_UNSUCCESSFUL;
    }

    RtlInitUnicodeString(&routineName, L"ExUnsubscribeWnfStateChange");
    ExUnsubscribeWnfStateChange = reinterpret_cast<EXUNSUBSCRIBEWNFSTATECHANGE>(MmGetSystemRoutineAddress(&routineName));
    if (!ExUnsubscribeWnfStateChange)
    {
        DbgPrint("[Driver] ExUnsubscribeWnfStateChange not found.\n");
        return STATUS_UNSUCCESSFUL;
    }

    // Subscribe to WNF state changes
    status = SubscribeToWNF();
    if (!NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Failed to subscribe to WNF state changes with status: 0x%X\n", status);
        return status;
    }

    // Register the process creation notify routine
    status = PsSetCreateProcessNotifyRoutine(ProcessNotifyCallback, FALSE);
    if (!NT_SUCCESS(status))
    {
        DbgPrint("[Driver] PsSetCreateProcessNotifyRoutine failed with status: 0x%X\n", status);
        // Unsubscribe from WNF before exiting
        if (g_WnfSubscription && ExUnsubscribeWnfStateChange)
            ExUnsubscribeWnfStateChange(g_WnfSubscription);

        return status;
    }

    // Set the unload routine
    DriverObject->DriverUnload = DriverUnloadRoutine;

    // Send handshake message to user-mode
    const CHAR handshakeMessage = "Kernel driver loaded";
    status = ExPublishWnfStateData(
        MY_WNF_STATE_NAME_VALUE,
        const_cast<CHAR>(handshakeMessage),
        static_cast<ULONG>(strlen(handshakeMessage) + 1),
        nullptr,
        nullptr,
        0
    );

    if (NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Handshake message published successfully.\n");
    }
    else
    {
        DbgPrint("[Driver] Failed to publish handshake message with status: 0x%X\n", status);
    }

    DbgPrint("[Driver] Driver loaded successfully.\n");
    return STATUS_SUCCESS;
}

// ==========================================================
// WNF Subscription Function Implementation
// ==========================================================

NTSTATUS SubscribeToWNF()
{
    if (!ExSubscribeWnfStateChange || !ExPublishWnfStateData || !ExUnsubscribeWnfStateChange)
    {
        DbgPrint("[Driver] WNF function pointers not initialized.\n");
        return STATUS_UNSUCCESSFUL;
    }

    // Subscribe to WNF state changes
    NTSTATUS status = ExSubscribeWnfStateChange(
        g_WnfSubscription,
        MY_WNF_STATE_NAME_VALUE,
        0, // ChangeStamp (0 for all changes)
        reinterpret_cast<PVOID>(OnWnfCallback),
        nullptr, // CallbackContext
        nullptr, // TypeId
        0,    // SerializationGroup
        0     // Unknown
    );

    if (NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Successfully subscribed to WNF state changes.\n");
    }
    else
    {
        DbgPrint("[Driver] ExSubscribeWnfStateChange failed with status: 0x%X\n", status);
    }

    return status;
}

// ==========================================================
// WNF Callback Function Implementation
// ==========================================================

NTSTATUS OnWnfCallback(
    PVOID Subscription,
    ULONG64 StateName,
    ULONG ChangeStamp,
    PVOID TypeId,
    PVOID CallbackContext,
    PVOID Buffer,
    ULONG BufferSize
)
{
    UNREFERENCED_PARAMETER(Subscription);
    UNREFERENCED_PARAMETER(StateName);
    UNREFERENCED_PARAMETER(ChangeStamp);
    UNREFERENCED_PARAMETER(TypeId);
    UNREFERENCED_PARAMETER(CallbackContext);

    NTSTATUS status = STATUS_SUCCESS;

    if (Buffer && BufferSize >= sizeof(INSTRUCTIONS))
    {
        PINSTRUCTIONS instructions = static_cast<PINSTRUCTIONS>(Buffer);

        if (instructions->read)
        {
            // Handle read request
            SIZE_T bytesRead = 0;
            BYTE readBuffer[1024] = { 0 };

            status = ReadProcessMemoryInternal(
                reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)),
                reinterpret_cast<PVOID>(static_cast<ULONGLONG>(instructions->address)),
                readBuffer,
                static_cast<SIZE_T>(instructions->size),
                &bytesRead
            );

            if (NT_SUCCESS(status))
            {
                // Encode the read data to Base64
                SIZE_T base64Size = ((bytesRead + 2) / 3) * 4;
                if (base64Size + 1 > sizeof(instructions->data))
                {
                    DbgPrint("[Driver] Read operation failed: Encoded data exceeds buffer size.\n");
                    status = ExPublishWnfStateData(
                        MY_WNF_STATE_NAME_VALUE,
                        "Read operation failed: Encoded data exceeds buffer size.",
                        static_cast<ULONG>(strlen("Read operation failed: Encoded data exceeds buffer size.") + 1),
                        nullptr,
                        nullptr,
                        0
                    );
                    return status;
                }

                CHAR encodedData[4096] = { 0 };
                SIZE_T encodedLength = 0;
                status = EncodeBase64(readBuffer, bytesRead, encodedData, sizeof(encodedData), &encodedLength);
                if (!NT_SUCCESS(status))
                {
                    DbgPrint("[Driver] EncodeBase64 failed with status: 0x%X\n", status);
                    status = ExPublishWnfStateData(
                        MY_WNF_STATE_NAME_VALUE,
                        "Read operation failed: Base64 encode failed.",
                        static_cast<ULONG>(strlen("Read operation failed: Base64 encode failed.") + 1),
                        nullptr,
                        nullptr,
                        0
                    );
                    return status;
                }

                // Prepare instructions to send back
                RtlZeroMemory(instructions->data, sizeof(instructions->data));
                RtlCopyMemory(instructions->data, encodedData, min(encodedLength, sizeof(instructions->data) - 1));
                instructions->size = bytesRead;

                // Publish the data back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                if (NT_SUCCESS(status))
                {
                    DbgPrint("[Driver] Read operation completed successfully. %zu bytes read, %zu bytes encoded.\n", bytesRead, encodedLength);
                }
                else
                {
                    DbgPrint("[Driver] ExPublishWnfStateData failed with status: 0x%X\n", status);
                }
            }
            else
            {
                // Handle read error
                DbgPrint("[Driver] ReadProcessMemoryInternal failed with status: 0x%X\n", status);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Read operation failed.",
                    static_cast<ULONG>(strlen("Read operation failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        else if (instructions->write)
        {
            // Handle write request
            SIZE_T bytesWritten = 0;

            // Decode Base64 data
            UCHAR decodedData[512] = { 0 };
            SIZE_T decodedSize = 0;
            status = DecodeBase64(reinterpret_cast<CHAR>(instructions->data), decodedData, sizeof(decodedData), &decodedSize);
            if (!NT_SUCCESS(status))
            {
                DbgPrint("[Driver] DecodeBase64 failed with status: 0x%X\n", status);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Write operation failed: Base64 decode failed.",
                    static_cast<ULONG>(strlen("Write operation failed: Base64 decode failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
                return status;
            }

            status = WriteProcessMemoryInternal(
                reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)),
                reinterpret_cast<PVOID>(static_cast<ULONGLONG>(instructions->address)),
                decodedData,
                decodedSize,
                &bytesWritten
            );

            if (NT_SUCCESS(status) && bytesWritten == decodedSize)
            {
                // Prepare instruction to send back
                instructions->size = bytesWritten;

                // Publish the success message back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                DbgPrint("[Driver] Write operation completed successfully. %zu bytes written to process %llu at address 0x%llX.\n",
                    bytesWritten, instructions->processId, instructions->address);
            }
            else
            {
                // Handle write error
                DbgPrint("[Driver] WriteProcessMemoryInternal failed with status: 0x%X and bytes written: %zu\n", status, bytesWritten);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Write operation failed.",
                    static_cast<ULONG>(strlen("Write operation failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        else if (instructions->close)
        {
            // Handle close instruction
            // Currently, no specific cleanup is required
            DbgPrint("[Driver] Received close instruction.\n");
        }
        else if (instructions->reqBase)
        {
            // Handle base address request
            PEPROCESS pProcess = nullptr;
            NTSTATUS statusLookup = PsLookupProcessByProcessId(reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)), &pProcess);
            if (NT_SUCCESS(statusLookup))
            {
                PVOID baseAddress = PsGetProcessSectionBaseAddress(pProcess);
                instructions->baseAddress = reinterpret_cast<UINT64>(baseAddress);
                ObDereferenceObject(pProcess);

                // Publish the base address back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                DbgPrint("[Driver] Base address of process %llu: %p\n", instructions->processId, baseAddress);
            }
            else
            {
                // Handle error
                DbgPrint("[Driver] PsLookupProcessByProcessId failed with status: 0x%X\n", statusLookup);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Base address request failed: PsLookupProcessByProcessId failed.",
                    static_cast<ULONG>(strlen("Base address request failed: PsLookupProcessByProcessId failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        // Additional instruction handling can be added here
    }
    else if (Buffer && BufferSize > 0)
    {
        // Handle simple messages like "Hi"
        // Allocate memory for received message, ensuring no buffer overflow
        CHAR receivedMessage = static_cast<CHAR>(ExAllocatePoolWithTag(NonPagedPoolNx, BufferSize + 1, 'msgK')); // 'msgK' tag
        if (!receivedMessage)
        {
            DbgPrint("[Driver] Failed to allocate memory for received message.\n");
            return STATUS_INSUFFICIENT_RESOURCES;
        }

        // Zero-initialize the allocated memory
        RtlZeroMemory(receivedMessage, BufferSize + 1);

        // Copy the received data, ensuring not to exceed the allocated buffer
        RtlCopyMemory(receivedMessage, Buffer, min(static_cast<SIZE_T>(BufferSize), static_cast<SIZE_T>(sizeof(CHAR) * (BufferSize))));

        DbgPrint("[Driver] Kernel received message: %s\n", receivedMessage);

        // Check if the message is 'Hi' and respond accordingly
        if (strcmp(receivedMessage, "Hi") == 0)
        {
            // Send handshake response
            const CHAR responseMessage = "Hello from kernel mode";
            status = ExPublishWnfStateData(
                MY_WNF_STATE_NAME_VALUE,
                const_cast<CHAR>(responseMessage),
                static_cast<ULONG>(strlen(responseMessage) + 1), // Include null terminator
                nullptr,
                nullptr,
                0
            );

            if (NT_SUCCESS(status))
            {
                DbgPrint("[Driver] Handshake response sent successfully.\n");
            }
            else
            {
                DbgPrint("[Driver] Failed to send handshake response with status: 0x%X\n", status);
            }
        }

        // Free the allocated memory for the received message
        ExFreePoolWithTag(receivedMessage, 'msgK');
    }
    else
    {
        // Handle unexpected or unsupported data
        DbgPrint("[Driver] Received invalid or unsupported data.\n");
    }

    return status;
}

// ==========================================================
// WNF Subscription Function Implementation
// ==========================================================

NTSTATUS SubscribeToWNF()
{
    if (!ExSubscribeWnfStateChange || !ExPublishWnfStateData || !ExUnsubscribeWnfStateChange)
    {
        DbgPrint("[Driver] WNF function pointers not initialized.\n");
        return STATUS_UNSUCCESSFUL;
    }

    // Subscribe to WNF state changes
    NTSTATUS status = ExSubscribeWnfStateChange(
        g_WnfSubscription,
        MY_WNF_STATE_NAME_VALUE,
        0, // ChangeStamp (0 for all changes)
        reinterpret_cast<PVOID>(OnWnfCallback),
        nullptr, // CallbackContext
        nullptr, // TypeId
        0,    // SerializationGroup
        0     // Unknown
    );

    if (NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Successfully subscribed to WNF state changes.\n");
    }
    else
    {
        DbgPrint("[Driver] ExSubscribeWnfStateChange failed with status: 0x%X\n", status);
    }

    return status;
}

// ==========================================================
// WNF Callback Function Implementation
// ==========================================================

NTSTATUS OnWnfCallback(
    PVOID Subscription,
    ULONG64 StateName,
    ULONG ChangeStamp,
    PVOID TypeId,
    PVOID CallbackContext,
    PVOID Buffer,
    ULONG BufferSize
)
{
    UNREFERENCED_PARAMETER(Subscription);
    UNREFERENCED_PARAMETER(StateName);
    UNREFERENCED_PARAMETER(ChangeStamp);
    UNREFERENCED_PARAMETER(TypeId);
    UNREFERENCED_PARAMETER(CallbackContext);

    NTSTATUS status = STATUS_SUCCESS;

    if (Buffer && BufferSize >= sizeof(INSTRUCTIONS))
    {
        PINSTRUCTIONS instructions = static_cast<PINSTRUCTIONS>(Buffer);

        if (instructions->read)
        {
            // Handle read request
            SIZE_T bytesRead = 0;
            BYTE readBuffer[1024] = { 0 };

            status = ReadProcessMemoryInternal(
                reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)),
                reinterpret_cast<PVOID>(static_cast<ULONGLONG>(instructions->address)),
                readBuffer,
                static_cast<SIZE_T>(instructions->size),
                &bytesRead
            );

            if (NT_SUCCESS(status))
            {
                // Encode the read data to Base64
                SIZE_T base64Size = ((bytesRead + 2) / 3) * 4;
                if (base64Size + 1 > sizeof(instructions->data))
                {
                    DbgPrint("[Driver] Read operation failed: Encoded data exceeds buffer size.\n");
                    status = ExPublishWnfStateData(
                        MY_WNF_STATE_NAME_VALUE,
                        "Read operation failed: Encoded data exceeds buffer size.",
                        static_cast<ULONG>(strlen("Read operation failed: Encoded data exceeds buffer size.") + 1),
                        nullptr,
                        nullptr,
                        0
                    );
                    return status;
                }

                CHAR encodedData[4096] = { 0 };
                SIZE_T encodedLength = 0;
                status = EncodeBase64(readBuffer, bytesRead, encodedData, sizeof(encodedData), &encodedLength);
                if (!NT_SUCCESS(status))
                {
                    DbgPrint("[Driver] EncodeBase64 failed with status: 0x%X\n", status);
                    status = ExPublishWnfStateData(
                        MY_WNF_STATE_NAME_VALUE,
                        "Read operation failed: Base64 encode failed.",
                        static_cast<ULONG>(strlen("Read operation failed: Base64 encode failed.") + 1),
                        nullptr,
                        nullptr,
                        0
                    );
                    return status;
                }

                // Prepare instructions to send back
                RtlZeroMemory(instructions->data, sizeof(instructions->data));
                RtlCopyMemory(instructions->data, encodedData, min(encodedLength, sizeof(instructions->data) - 1));
                instructions->size = bytesRead;

                // Publish the data back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                if (NT_SUCCESS(status))
                {
                    DbgPrint("[Driver] Read operation completed successfully. %zu bytes read, %zu bytes encoded.\n", bytesRead, encodedLength);
                }
                else
                {
                    DbgPrint("[Driver] ExPublishWnfStateData failed with status: 0x%X\n", status);
                }
            }
            else
            {
                // Handle read error
                DbgPrint("[Driver] ReadProcessMemoryInternal failed with status: 0x%X\n", status);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Read operation failed.",
                    static_cast<ULONG>(strlen("Read operation failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        else if (instructions->write)
        {
            // Handle write request
            SIZE_T bytesWritten = 0;

            // Decode Base64 data
            UCHAR decodedData[512] = { 0 };
            SIZE_T decodedSize = 0;
            status = DecodeBase64(reinterpret_cast<CHAR*>(instructions->data), decodedData, sizeof(decodedData), &decodedSize);
            if (!NT_SUCCESS(status))
            {
                DbgPrint("[Driver] DecodeBase64 failed with status: 0x%X\n", status);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Write operation failed: Base64 decode failed.",
                    static_cast<ULONG>(strlen("Write operation failed: Base64 decode failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
                return status;
            }

            status = WriteProcessMemoryInternal(
                reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)),
                reinterpret_cast<PVOID>(static_cast<ULONGLONG>(instructions->address)),
                decodedData,
                decodedSize,
                &bytesWritten
            );

            if (NT_SUCCESS(status) && bytesWritten == decodedSize)
            {
                // Prepare instruction to send back
                instructions->size = bytesWritten;

                // Publish the success message back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                DbgPrint("[Driver] Write operation completed successfully. %zu bytes written to process %llu at address 0x%llX.\n",
                    bytesWritten, instructions->processId, instructions->address);
            }
            else
            {
                // Handle write error
                DbgPrint("[Driver] WriteProcessMemoryInternal failed with status: 0x%X and bytes written: %zu\n", status, bytesWritten);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Write operation failed.",
                    static_cast<ULONG>(strlen("Write operation failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        else if (instructions->close)
        {
            // Handle close instruction
            // Currently, no specific cleanup is required
            DbgPrint("[Driver] Received close instruction.\n");
            // Additional cleanup logic can be implemented here if needed
        }
        else if (instructions->reqBase)
        {
            // Handle base address request
            PEPROCESS pProcess = nullptr;
            NTSTATUS statusLookup = PsLookupProcessByProcessId(reinterpret_cast<HANDLE>(static_cast<ULONGLONG>(instructions->processId)), &pProcess);
            if (NT_SUCCESS(statusLookup))
            {
                PVOID baseAddress = PsGetProcessSectionBaseAddress(pProcess);
                instructions->baseAddress = reinterpret_cast<UINT64>(baseAddress);
                ObDereferenceObject(pProcess);

                // Publish the base address back via WNF
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    instructions,
                    sizeof(INSTRUCTIONS),
                    nullptr,
                    nullptr,
                    0
                );

                DbgPrint("[Driver] Base address of process %llu: %p\n", instructions->processId, baseAddress);
            }
            else
            {
                // Handle error
                DbgPrint("[Driver] PsLookupProcessByProcessId failed with status: 0x%X\n", statusLookup);
                status = ExPublishWnfStateData(
                    MY_WNF_STATE_NAME_VALUE,
                    "Base address request failed: PsLookupProcessByProcessId failed.",
                    static_cast<ULONG>(strlen("Base address request failed: PsLookupProcessByProcessId failed.") + 1),
                    nullptr,
                    nullptr,
                    0
                );
            }
        }
        // Additional instruction handling can be added here
    }
    else if (Buffer && BufferSize > 0)
    {
        // Handle simple messages like "Hi"
        // Allocate memory for received message, ensuring no buffer overflow
        CHAR* receivedMessage = static_cast<CHAR*>(ExAllocatePoolWithTag(NonPagedPoolNx, BufferSize + 1, 'msgK')); // 'msgK' tag
        if (!receivedMessage)
        {
            DbgPrint("[Driver] Failed to allocate memory for received message.\n");
            return STATUS_INSUFFICIENT_RESOURCES;
        }

        // Zero-initialize the allocated memory
        RtlZeroMemory(receivedMessage, BufferSize + 1);

        // Copy the received data, ensuring not to exceed the allocated buffer
        RtlCopyMemory(receivedMessage, Buffer, min(static_cast<SIZE_T>(BufferSize), static_cast<SIZE_T>(sizeof(CHAR) * (BufferSize))));

        DbgPrint("[Driver] Kernel received message: %s\n", receivedMessage);

        // Check if the message is 'Hi' and respond accordingly
        if (strcmp(receivedMessage, "Hi") == 0)
        {
            // Send handshake response
            const CHAR* responseMessage = "Hello from kernel mode";
            status = ExPublishWnfStateData(
                MY_WNF_STATE_NAME_VALUE,
                const_cast<CHAR*>(responseMessage),
                static_cast<ULONG>(strlen(responseMessage) + 1), // Include null terminator
                nullptr,
                nullptr,
                0
            );

            if (NT_SUCCESS(status))
            {
                DbgPrint("[Driver] Handshake response sent successfully.\n");
            }
            else
            {
                DbgPrint("[Driver] Failed to send handshake response with status: 0x%X\n", status);
            }
        }

        // Free the allocated memory for the received message
        ExFreePoolWithTag(receivedMessage, 'msgK');
    }
    else
    {
        // Handle unexpected or unsupported data
        DbgPrint("[Driver] Received invalid or unsupported data.\n");
    }

    return status;
}

// ==========================================================
// Process Notification Callback Implementation
// ==========================================================

VOID ProcessNotifyCallback(
    __in HANDLE ParentId,
    __in HANDLE ProcessId,
    __in BOOLEAN Create
)
{
    UNREFERENCED_PARAMETER(ParentId);

    if (Create)
    {
        PEPROCESS pProcess = nullptr;
        NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &pProcess);
        if (NT_SUCCESS(status))
        {
            // Get process image file name
            UNICODE_STRING uProcessImageName = { 0 };
            status = SeLocateProcessImageName(pProcess, &uProcessImageName);
            if (NT_SUCCESS(status))
            {
                // Extract file name from full path
                PWSTR processName = wcsrchr(uProcessImageName.Buffer, L'\'); // Corrected backslash
                    if (processName)
                    {
                        processName++; // Move past the backslash

                        // Check if this is the target process
                        if (_wcsicmp(processName, TARGET_PROCESS_NAME) == 0)
                        {
                            // Perform memory operations here (if needed)
                            PVOID baseAddress = GetProcessBaseAddress(ProcessId);
                            if (baseAddress)
                            {
                                DbgPrint("[Driver] Target process '%ws' created with base address: %p\n", processName, baseAddress);

                                // Example: Read some memory from the process
                                BYTE buffer[256] = { 0 };
                                SIZE_T bytesRead = 0;
                                NTSTATUS ntStatus = ReadProcessMemoryInternal(
                                    reinterpret_cast<HANDLE>(ProcessId),
                                    baseAddress,
                                    buffer,
                                    sizeof(buffer),
                                    &bytesRead
                                );

                                if (NT_SUCCESS(ntStatus))
                                {
                                    DbgPrint("[Driver] Successfully read %zu bytes from '%ws'.\n", bytesRead, processName);
                                }
                                else
                                {
                                    DbgPrint("[Driver] Failed to read memory of '%ws' with status: 0x%X\n", processName, ntStatus);
                                }

                                // Example: Write to process memory (commented out for safety)
                                /
                                    BYTE writeData[256] = { / Your data here * / };
                                SIZE_T bytesWritten = 0;
                                ntStatus = WriteProcessMemoryInternal(
                                    reinterpret_cast<HANDLE>(ProcessId),
                                    baseAddress,
                                    writeData,
                                    sizeof(writeData),
                                    &bytesWritten
                                );

                                if (NT_SUCCESS(ntStatus))
                                {
                                    DbgPrint("[Driver] Successfully wrote %zu bytes to '%ws'.\n", bytesWritten, processName);
                                }
                                else
                                {
                                    DbgPrint("[Driver] Failed to write memory of '%ws' with status: 0x%X\n", processName, ntStatus);
                                }
                                /
                            }
                            else
                            {
                                DbgPrint("[Driver] Failed to retrieve base address of process ID: %llu\n", ProcessId);
                            }
                        }
                    }
                    else
                    {
                        DbgPrint("[Driver] Failed to parse process name for PID: %llu\n", ProcessId);
                    }

                // Free the allocated image name buffer
                ExFreePoolWithTag(uProcessImageName.Buffer, 'imgN');
            }
            else
            {
                DbgPrint("[Driver] SeLocateProcessImageName failed with status: 0x%X for PID: %llu\n", status, ProcessId);
            }

            ObDereferenceObject(pProcess);
        }
        else
        {
            DbgPrint("[Driver] PsLookupProcessByProcessId failed with status: 0x%X for PID: %llu\n", status, ProcessId);
        }
    }
}

// ==========================================================
// Driver Unload Routine Implementation
// ==========================================================

VOID DriverUnloadRoutine(PDRIVER_OBJECT DriverObject)
{
    UNREFERENCED_PARAMETER(DriverObject);

    // Unsubscribe from WNF
    if (g_WnfSubscription && ExUnsubscribeWnfStateChange)
    {
        NTSTATUS status = ExUnsubscribeWnfStateChange(g_WnfSubscription);
        if (NT_SUCCESS(status))
        {
            DbgPrint("[Driver] Successfully unsubscribed from WNF state changes.\n");
        }
        else
        {
            DbgPrint("[Driver] ExUnsubscribeWnfStateChange failed with status: 0x%X\n", status);
        }
        g_WnfSubscription = nullptr;
    }

    // Remove the process notify routine
    NTSTATUS status = PsSetCreateProcessNotifyRoutine(ProcessNotifyCallback, TRUE);
    if (NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Successfully removed process notify routine.\n");
    }
    else
    {
        DbgPrint("[Driver] PsSetCreateProcessNotifyRoutine removal failed with status: 0x%X\n", status);
    }

    DbgPrint("[Driver] Driver unloaded.\n");
}

// ==========================================================
// DriverEntry Function Implementation
// ==========================================================

NTSTATUS DriverEntryRoutine(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    UNREFERENCED_PARAMETER(RegistryPath);

    NTSTATUS status;

    // Resolve WNF functions
    UNICODE_STRING routineName;
    RtlInitUnicodeString(&routineName, L"ExSubscribeWnfStateChange");
    ExSubscribeWnfStateChange = reinterpret_cast<EXSUBSCRIBEWNFSTATECHANGE>(MmGetSystemRoutineAddress(&routineName));
    if (!ExSubscribeWnfStateChange)
    {
        DbgPrint("[Driver] ExSubscribeWnfStateChange not found.\n");
        return STATUS_UNSUCCESSFUL;
    }

    RtlInitUnicodeString(&routineName, L"ExPublishWnfStateData");
    ExPublishWnfStateData = reinterpret_cast<EXPUBLISHWNFSTATEDATA>(MmGetSystemRoutineAddress(&routineName));
    if (!ExPublishWnfStateData)
    {
        DbgPrint("[Driver] ExPublishWnfStateData not found.\n");
        return STATUS_UNSUCCESSFUL;
    }

    RtlInitUnicodeString(&routineName, L"ExUnsubscribeWnfStateChange");
    ExUnsubscribeWnfStateChange = reinterpret_cast<EXUNSUBSCRIBEWNFSTATECHANGE>(MmGetSystemRoutineAddress(&routineName));
    if (!ExUnsubscribeWnfStateChange)
    {
        DbgPrint("[Driver] ExUnsubscribeWnfStateChange not found.\n");
        return STATUS_UNSUCCESSFUL;
    }

    // Subscribe to WNF state changes
    status = SubscribeToWNF();
    if (!NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Failed to subscribe to WNF state changes with status: 0x%X\n", status);
        return status;
    }

    // Register the process creation notify routine
    status = PsSetCreateProcessNotifyRoutine(ProcessNotifyCallback, FALSE);
    if (!NT_SUCCESS(status))
    {
        DbgPrint("[Driver] PsSetCreateProcessNotifyRoutine failed with status: 0x%X\n", status);
        // Unsubscribe from WNF before exiting
        if (g_WnfSubscription && ExUnsubscribeWnfStateChange)
            ExUnsubscribeWnfStateChange(g_WnfSubscription);

        return status;
    }

    // Set the unload routine
    DriverObject->DriverUnload = DriverUnloadRoutine;

    // Send handshake message to user-mode
    const CHAR handshakeMessage = "Kernel driver loaded";
    status = ExPublishWnfStateData(
        MY_WNF_STATE_NAME_VALUE,
        const_cast<CHAR*>(handshakeMessage),
        static_cast<ULONG>(strlen(handshakeMessage) + 1),
        nullptr,
        nullptr,
        0
    );

    if (NT_SUCCESS(status))
    {
        DbgPrint("[Driver] Handshake message published successfully.\n");
    }
    else
    {
        DbgPrint("[Driver] Failed to publish handshake message with status: 0x%X\n", status);
    }

    DbgPrint("[Driver] Driver loaded successfully.\n");
    return STATUS_SUCCESS;
}
Severity	Code	Description	Project	File	Line	Suppression State	Details
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	646		
Error (active)	E0090	function returning function is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	33		
Error (active)	E0090	function returning function is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	43		
Error (active)	E0090	function returning function is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	51		
Error (active)	E0145	function "ExSubscribeWnfStateChange" may not be initialized	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	57		
Error (active)	E0145	function "ExPublishWnfStateData" may not be initialized	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	58		
Error (active)	E0145	function "ExUnsubscribeWnfStateChange" may not be initialized	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	59		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	71		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	72		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	73		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	74		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	82		
Error (active)	E0020	identifier "DWORD" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	95		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	97		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	97		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	97		
Error (active)	E0020	identifier "DWORD" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	145		
Error (active)	E0167	argument of type "SIZE_T" (aka "unsigned long long") is incompatible with parameter of type "PSIZE_T" (aka "unsigned long long *")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	175		
Error (active)	E0513	a value of type "SIZE_T" (aka "unsigned long long") cannot be assigned to an entity of type "SIZE_T *" (aka "unsigned long long *")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	193		
Error (active)	E0144	a value of type "ULONG_PTR *" (aka "unsigned long long *") cannot be used to initialize an entity of type "ULONG_PTR" (aka "unsigned long long")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	203		
Error (active)	E0020	identifier "DWORD" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	211		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	219		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	219		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	219		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	223		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	224		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	225		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	226		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	227		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	230		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	238		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	248		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	258		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	263		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	279		
Error (active)	E0020	identifier "uint64_t" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	314		
Error (active)	E2140	expression must have integral or unscoped enum type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	425		
Error (active)	E2140	expression must have integral or unscoped enum type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	430		
Error (active)	E2140	expression must have integral or unscoped enum type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	436		
Error (active)	E0142	expression must have pointer-to-object type but it has type "SIZE_T" (aka "unsigned long long")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	459		
Error (active)	E0142	expression must have pointer-to-object type but it has type "unsigned long long"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	460		
Error (active)	E0142	expression must have pointer-to-object type but it has type "unsigned long long"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	461		
Error (active)	E0142	expression must have pointer-to-object type but it has type "SIZE_T" (aka "unsigned long long")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	463		
Error (active)	E0142	expression must have pointer-to-object type but it has type "SIZE_T" (aka "unsigned long long")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	465		
Error (active)	E0142	expression must have pointer-to-object type but it has type "SIZE_T" (aka "unsigned long long")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	467		
Error (active)	E0142	expression must have pointer-to-object type but it has type "SIZE_T" (aka "unsigned long long")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	469		
Error (active)	E0142	expression must have pointer-to-object type but it has type "SIZE_T" (aka "unsigned long long")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	476		
Error (active)	E0142	expression must have pointer-to-object type but it has type "unsigned long long"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	480		
Error (active)	E0020	identifier "PsGetProcessSectionBaseAddress" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	497		
Error (active)	E0415	no suitable constructor exists to convert from "PVOID" (aka "void *") to "INSTRUCTIONS"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	544		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	546		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	550		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	553		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	554		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	556		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	564		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	568		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	585		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	596		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	597		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	598		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	602		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	624		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	633		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	641		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	657		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	658		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	667		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	671		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	680		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	680		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	687		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	696		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	702		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	706		
Error (active)	E0020	identifier "PsGetProcessSectionBaseAddress" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	709		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	710		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	715		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	723		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	730		
Error (active)	E0171	invalid type conversion	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	744		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "void *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	751		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "void *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	752		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "const char *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	756		
Error (active)	E0144	a value of type "const char *" cannot be used to initialize an entity of type "const CHAR"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	759		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	761		
Error (active)	E0717	the type in a const_cast must be a pointer, reference, or pointer to member to an object type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	762		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "const char *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	763		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "PVOID" (aka "void *")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	779		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	804		
Error (active)	E0167	argument of type "UNICODE_STRING *" (aka "_UNICODE_STRING *") is incompatible with parameter of type "PUNICODE_STRING *" (aka "_UNICODE_STRING **")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	846		
Error (active)	E0008	missing closing quote	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	850		
Error (active)	E0018	expected a ')'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	851		
Error (active)	E0020	identifier "ntStatus" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	875		
Error (active)	E0020	identifier "bytesRead" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	877		
Error (active)	E0029	expected an expression	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	885		
Error (active)	E0020	identifier "baseAddress" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	890		
Error (active)	E0020	identifier "writeData" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	891		
Error (active)	E0029	expected an expression	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	904		
Error (active)	E0065	expected a ';'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	905		
Error (active)	E0020	identifier "uProcessImageName" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	918		
Error (active)	E0169	expected a declaration	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	920		
Error (active)	E0169	expected a declaration	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	926		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	945		
Error (active)	E0137	expression must be a modifiable lvalue	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	984		
Error (active)	E0119	cast to type "EXSUBSCRIBEWNFSTATECHANGE" (aka "<error-type> ()") is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	984		
Error (active)	E0137	expression must be a modifiable lvalue	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	992		
Error (active)	E0119	cast to type "EXPUBLISHWNFSTATEDATA" (aka "<error-type> ()") is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	992		
Error (active)	E0137	expression must be a modifiable lvalue	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1000		
Error (active)	E0119	cast to type "EXUNSUBSCRIBEWNFSTATECHANGE" (aka "<error-type> ()") is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1000		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1022		
Error (active)	E0144	a value of type "const char *" cannot be used to initialize an entity of type "const CHAR"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1031		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1033		
Error (active)	E0717	the type in a const_cast must be a pointer, reference, or pointer to member to an object type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1034		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "const char *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1035		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1068		
Error (active)	E0415	no suitable constructor exists to convert from "PVOID" (aka "void *") to "INSTRUCTIONS"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1114		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1116		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1120		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1123		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1124		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1126		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1134		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1138		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1155		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1166		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1167		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1168		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1172		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1194		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1203		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1211		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1216		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1227		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1228		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1237		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1241		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1250		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1250		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1257		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1266		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1272		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1276		
Error (active)	E0020	identifier "PsGetProcessSectionBaseAddress" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1279		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1280		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1285		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1293		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1300		
Error (active)	E0171	invalid type conversion	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1315		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "void *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1323		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "void *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1326		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "const char *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1331		
Error (active)	E0144	a value of type "const char *" cannot be used to initialize an entity of type "const CHAR"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1334		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1336		
Error (active)	E0717	the type in a const_cast must be a pointer, reference, or pointer to member to an object type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1337		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "const char *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1338		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "PVOID" (aka "void *")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1355		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1380		
Error (active)	E0415	no suitable constructor exists to convert from "PVOID" (aka "void *") to "INSTRUCTIONS"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1426		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1428		
Error (active)	E0020	identifier "BYTE" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1432		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1435		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1436		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1438		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1446		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1450		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1467		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1478		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1479		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1480		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1484		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1506		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1515		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1523		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1528		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1539		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1540		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1549		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1553		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1562		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1562		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1569		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1578		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1585		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1589		
Error (active)	E0020	identifier "PsGetProcessSectionBaseAddress" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1592		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1593		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1598		
Error (active)	E3364	operator -> or ->* applied to "PINSTRUCTIONS" (aka "INSTRUCTIONS") instead of to a pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1606		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1613		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1649		
Error (active)	E0167	argument of type "UNICODE_STRING *" (aka "_UNICODE_STRING *") is incompatible with parameter of type "PUNICODE_STRING *" (aka "_UNICODE_STRING **")	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1699		
Error (active)	E0008	missing closing quote	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1703		
Error (active)	E0018	expected a ')'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1704		
Error (active)	E0020	identifier "ntStatus" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1728		
Error (active)	E0020	identifier "bytesRead" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1730		
Error (active)	E0029	expected an expression	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1738		
Error (active)	E0020	identifier "baseAddress" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1743		
Error (active)	E0020	identifier "writeData" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1744		
Error (active)	E0029	expected an expression	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1757		
Error (active)	E0065	expected a ';'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1758		
Error (active)	E0020	identifier "uProcessImageName" is undefined	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1771		
Error (active)	E0169	expected a declaration	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1773		
Error (active)	E0169	expected a declaration	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1779		
Error (active)	E0169	expected a declaration	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1815		
Error (active)	E0169	expected a declaration	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1822		
Error (active)	E0137	expression must be a modifiable lvalue	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1837		
Error (active)	E0119	cast to type "EXSUBSCRIBEWNFSTATECHANGE" (aka "<error-type> ()") is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1837		
Error (active)	E0137	expression must be a modifiable lvalue	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1845		
Error (active)	E0119	cast to type "EXPUBLISHWNFSTATEDATA" (aka "<error-type> ()") is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1845		
Error (active)	E0137	expression must be a modifiable lvalue	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1853		
Error (active)	E0119	cast to type "EXUNSUBSCRIBEWNFSTATECHANGE" (aka "<error-type> ()") is not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1853		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1875		
Error (active)	E0144	a value of type "const char *" cannot be used to initialize an entity of type "const CHAR"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1884		
Error (active)	E0140	too many arguments in function call	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1886		
Error (active)	E0718	a const_cast can only adjust type qualifiers; it cannot change the underlying type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1887		
Error (active)	E0167	argument of type "CHAR" (aka "char") is incompatible with parameter of type "const char *"	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	1888		
Warning	VCR001	Function definition for 'NTSTATUS' not found.		C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	33		
Warning	VCR001	Function definition for 'NTSTATUS' not found.		C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	43		
Warning	VCR001	Function definition for 'NTSTATUS' not found.		C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	51		
Warning	VCR001	Function definition for 'ReadVirtualMemory' not found.		C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	100		
Warning	VCR001	Function definition for 'WriteVirtualMemory' not found.		C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	101		
Warning	VCR001	Function definition for 'ReadProcessMemoryInternal' not found.		C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	104		
Warning	VCR001	Function definition for 'EncodeBase64' not found.		C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	122		
Error	C2187	syntax error: '(' was unexpected here	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	33		
Error	C2377	'ULONG64': redefinition; typedef cannot be overloaded with any other symbol	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	34		
Error	C2146	syntax error: missing ';' before identifier 'StateName'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	34		
Error	C2059	syntax error: ','	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	34		
Error	C2059	syntax error: ')'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	41		
Error	C2187	syntax error: '(' was unexpected here	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	43		
Error	C2040	'ULONG64': 'int' differs in levels of indirection from 'PVOID'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	43		
Error	C2146	syntax error: missing ';' before identifier 'StateName'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	43		
Error	C2059	syntax error: ')'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	49		
Error	C2187	syntax error: '(' was unexpected here	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	51		
Error	C2059	syntax error: ')'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	51		
Error	C2086	'PVOID Subscription': redefinition	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	51		
Error	C2146	syntax error: missing ';' before identifier 'ExSubscribeWnfStateChange'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	57		
Error	C2146	syntax error: missing ';' before identifier 'ExPublishWnfStateData'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	58		
Error	C2146	syntax error: missing ';' before identifier 'ExUnsubscribeWnfStateChange'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	59		
Error	C2040	'ULONG64': 'int' differs in levels of indirection from 'PVOID'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	61		
Error	C2146	syntax error: missing ';' before identifier 'MY_WNF_STATE_NAME_VALUE'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	61		
Error	C3646	'close': unknown override specifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	71		
Error	C3646	'read': unknown override specifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	72		
Error	C3646	'write': unknown override specifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	73		
Error	C3646	'reqBase': unknown override specifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	74		
Error	C3646	'data': unknown override specifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	82		
Error	C2143	syntax error: missing ',' before '['	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	82		
Error	C2238	unexpected token(s) preceding ';'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	82		
Error	C2146	syntax error: missing ';' before identifier 'GetUserDirectoryTableBaseOffset'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	95		
Error	C2146	syntax error: missing ';' before identifier 'TranslateLinearAddress'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	97		
Error	C2061	syntax error: identifier 'ULONG64'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	110		
Error	C2086	'int DWORD': redefinition	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	145		
Error	C2146	syntax error: missing ';' before identifier 'GetUserDirectoryTableBaseOffset'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	145		
Error	C2143	syntax error: missing ';' before '{'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	146		
Error	C2447	'{': missing function header (old-style formal list?)	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	146		
Error	C2664	'NTSTATUS MmCopyMemory(PVOID,MM_COPY_ADDRESS,SIZE_T,ULONG,PSIZE_T)': cannot convert argument 5 from 'SIZE_T' to 'PSIZE_T'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	175		
Error	C2440	'=': cannot convert from 'SIZE_T' to 'SIZE_T *'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	193		
Error	C2440	'initializing': cannot convert from 'ULONG_PTR *' to 'ULONG_PTR'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	203		
Error	C2146	syntax error: missing ';' before identifier 'UserDirOffset'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	211		
Error	C2065	'UserDirOffset': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	211		
Error	C3861	'GetUserDirectoryTableBaseOffset': identifier not found	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	211		
Error	C2065	'UserDirOffset': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	212		
Error	C2086	'int uint64_t': redefinition	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	219		
Error	C2146	syntax error: missing ';' before identifier 'TranslateLinearAddress'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	219		
Error	C2143	syntax error: missing ';' before '{'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	220		
Error	C2447	'{': missing function header (old-style formal list?)	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	220		
Error	C2146	syntax error: missing ';' before identifier 'physAddress'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	279		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	279		
Error	C3861	'TranslateLinearAddress': identifier not found	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	279		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	280		
Error	C2146	syntax error: missing ';' before identifier 'readSize'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	286		
Error	C2065	'readSize': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	286		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	286		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	288		
Error	C2065	'readSize': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	288		
Error	C2146	syntax error: missing ';' before identifier 'physAddress'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	314		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	314		
Error	C3861	'TranslateLinearAddress': identifier not found	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	314		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	315		
Error	C2146	syntax error: missing ';' before identifier 'writeSize'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	321		
Error	C2065	'writeSize': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	321		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	321		
Error	C2065	'physAddress': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	323		
Error	C2065	'writeSize': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	323		
Error	C2107	illegal index, indirection not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	425		
Error	C2107	illegal index, indirection not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	430		
Error	C2107	illegal index, indirection not allowed	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	436		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	459		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	460		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	461		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	463		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	465		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	467		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	469		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	476		
Error	C2109	subscript requires array or pointer type	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	480		
Error	C3861	'PsGetProcessSectionBaseAddress': identifier not found	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	497		
Error	C2084	function 'NTSTATUS ReadProcessMemoryInternal(HANDLE,PVOID,PVOID,SIZE_T,SIZE_T)' already has a body	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	503		
Error	C2264	'ReadProcessMemoryInternal': error in function definition or declaration; function not called	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	508		
Error	C2061	syntax error: identifier 'ULONG64'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	526		
Warning	C4459	declaration of 'Subscription' hides global declaration	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	525		
Error	C2065	'StateName': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	535		
Error	C2065	'ChangeStamp': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	536		
Error	C2065	'TypeId': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	537		
Error	C2065	'CallbackContext': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	538		
Error	C2065	'Buffer': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	542		
Error	C2065	'BufferSize': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	542		
Error	C2065	'Buffer': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	544		
Error	C2819	type 'INSTRUCTIONS' does not have an overloaded member 'operator ->'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	546		
Error	C2039	'read': is not a member of 'INSTRUCTIONS'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	546		
Error	C2065	'BYTE': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	550		
Error	C2146	syntax error: missing ';' before identifier 'readBuffer'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	550		
Error	C2065	'readBuffer': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	550		
Error	C2819	type 'INSTRUCTIONS' does not have an overloaded member 'operator ->'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	553		
Error	C2232	'->INSTRUCTIONS::processId': left operand has 'struct' type, use '.'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	553		
Error	C2819	type 'INSTRUCTIONS' does not have an overloaded member 'operator ->'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	554		
Error	C2232	'->INSTRUCTIONS::address': left operand has 'struct' type, use '.'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	554		
Error	C2065	'readBuffer': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	555		
Error	C2819	type 'INSTRUCTIONS' does not have an overloaded member 'operator ->'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	556		
Error	C2232	'->INSTRUCTIONS::size': left operand has 'struct' type, use '.'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	556		
Error	C2661	'ReadProcessMemoryInternal': no overloaded function takes 3 arguments	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	552		
Error	C2819	type 'INSTRUCTIONS' does not have an overloaded member 'operator ->'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	564		
Error	C2039	'data': is not a member of 'INSTRUCTIONS'	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	564		
Error	C2065	'MY_WNF_STATE_NAME_VALUE': undeclared identifier	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	568		
Error	C1003	error count exceeds 100; stopping compilation	KMDF Driver7	C:\Users\ruth_\source\repos\KMDF Driver7\KMDF Driver7\main.cpp	568		
fix