DriverUnloadAnatomy.cpp

#pragma warning(disable: 4996)

#include <ntddk.h>

void DriverCleanup(PDRIVER_OBJECT DriverObject);

PVOID someAllocation;

extern "C"
NTSTATUS
DriverEntry(
	_In_ PDRIVER_OBJECT DriverObject,
	_In_ PUNICODE_STRING RegistryPath)
{
	UNREFERENCED_PARAMETER(RegistryPath);

	DbgPrint("[+] Hello from FirstDriver DriverEntry\n");

	DriverObject->DriverUnload = DriverCleanup;

	someAllocation = ExAllocatePoolWithTag(
		PagedPool,
		1024,
		'TAG1');

	DbgPrint("[+] Memory allocated at 0x%08p", someAllocation);

	return STATUS_SUCCESS;
}

void
DriverCleanup(
	PDRIVER_OBJECT DriverObject
)
{
	UNREFERENCED_PARAMETER(DriverObject);

	DbgPrint("[+] Hello from FirstDriver DriverUnload\n");
	DbgPrint("[+] Freeing memory at 0x%08p", someAllocation);

	ExFreePoolWithTag(
		someAllocation,
		'TAG1');

	DbgPrint("[+] Memory freed\n");
}