TDL loaded driver gets unloaded

[hfiref0x]

TDL loaded driver gets unloaded

[hfiref0x]

You must be don't understand purpose of TDL or how it work. It doesn't use Windows loader code to map driver code, so why it should be listed in Windows loader list?

well since the last issue is a little out of context (the msg above) & since i have tested tdl on multiple platforms & native machine's & vm's. i can inform you that on win 10.0.15063 (latest stable release) it WORKS PERFECTLY well while using dummy.sys (NO PROBLEMS AT ALL!). but if you try to load dummy2.sys, then it KeBugCheckEx with irql_not_less_or_equal. from the dmp file this is due to a WRITE & EXECUTE error to a pageble/invalid address & it persists on any native machine/vm that i have tested. given a link to the minidmp zipped & the debugging session in plain text. THIS IS NOT AN ISSUE but sharing my testing on this project. idk if you addressed that already, anyways i admire your work very much, and i think that this project is important as it simply bypass one of windows major 'security features' and i think that there should exist at least one of those for every win update. ty for making this project an open source! link: (github download http://tiny.cc/1iebny the zipped dmp + session)

[hfiref0x]

#15