To be loaded via TDL. Based on https://github.com/hfiref0x/TDL/blob/master/Source/DummyDrv/dummy/main.c

vmkoth_vga_driver.c

/*******************************************************************************
*
*  (C) COPYRIGHT AUTHORS, 2016 - 2017
*
*  TITLE:       MAIN.C
*
*  VERSION:     1.01
*
*  DATE:        20 Apr 2017
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
* PARTICULAR PURPOSE.
*
*******************************************************************************/

#include <ntddk.h>

DRIVER_INITIALIZE DriverEntry;
#pragma alloc_text(INIT, DriverEntry)

char qr[] = \
"                       "\
" #######  # ## ####### "\
" #     # ## #  #     # "\
" # ### # ##  # # ### # "\
" # ### #  # #  # ### # "\
" # ### # #   # # ### # "\
" #     # #  ## #     # "\
" ####### # # # ####### "\
"         #####         "\
" ## #  ## ##   ### ##  "\
"  ##  #    #   ##   ## "\
" ##### ## ## ##   ## # "\
"      # # # #   # # #  "\
" #    ##     # ####  # "\
"         # ##   #   #  "\
" ####### ##   # #####  "\
" #     #   ####      # "\
" # ### #   ##  # ##  # "\
" # ### # #  #   ##  ## "\
" # ### #   # #  ##   # "\
" #     # ###  #####    "\
" ####### # ###   #  #  "\
"                       ";
/*
* DriverEntry
*
* Purpose:
*
* Driver base entry point.
*
*/
NTSTATUS DriverEntry(
    _In_  struct _DRIVER_OBJECT *DriverObject,
    _In_  PUNICODE_STRING RegistryPath
)
{
    PEPROCESS Process;
    KIRQL Irql;
    PWSTR sIrql;

    /* This parameters are invalid due to nonstandard way of loading and should not be used. */
    UNREFERENCED_PARAMETER(DriverObject);
    UNREFERENCED_PARAMETER(RegistryPath);

    DbgPrint("Hello from kernel mode, system range start is %p, code mapped at %p\n", MmSystemRangeStart, DriverEntry);

    Process = PsGetCurrentProcess();
    DbgPrint("I'm at %s, Process : %lu (%p)\n",
        __FUNCTION__,
        (ULONG)PsGetCurrentProcessId(),
        Process);

    Irql = KeGetCurrentIrql();

    switch (Irql) {

    case PASSIVE_LEVEL:
        sIrql = L"PASSIVE_LEVEL";
        break;
    case APC_LEVEL:
        sIrql = L"APC_LEVEL";
        break;
    case DISPATCH_LEVEL:
        sIrql = L"DISPATCH_LEVEL";
        break;
    case CMCI_LEVEL:
        sIrql = L"CMCI_LEVEL";
        break;
    case CLOCK_LEVEL:
        sIrql = L"CLOCK_LEVEL";
        break;
    case IPI_LEVEL:
        sIrql = L"IPI_LEVEL";
        break;
    case HIGH_LEVEL:
        sIrql = L"HIGH_LEVEL";
        break;
    default:
        sIrql = L"Unknown Value";
        break;
    }

    DbgPrint("KeGetCurrentIrql=%ws\n", sIrql);


	char * vram = MmMapIoSpace((PHYSICAL_ADDRESS) { .QuadPart = 0xfc000000 }, 1024 * 768 * 3, MmWriteCombined);
	for (int j = 1; j; j++) {
		for (int y = 0; y < 23; y++) {
			for (int x = 0; x < 1024; x++) {
				char tmp = (qr[(x%23) + y * 23] == '#') - 1;
				vram[(x + y * 1024) * 3] = tmp;
				vram[(x + y * 1024) * 3+1] = tmp;
				vram[(x + y * 1024) * 3+2] = tmp;
			}
		}

		for (int i = 1024 * 3 * 23; i < 1024 * 768 * 3; i++) vram[i] = (char)i*i+j;
	}

    return STATUS_SUCCESS;
}