Ghost.c

The file Ghost.c has been expanded by the addition of two global variables:

  PVOID kernel32Base = NULL; ZWPROTECTVIRTUALMEMORY OldZwProtectVirtualMemory; 

Kernel32Base is supplied by ZwMapViewOfSection when the mapped library is kernel32.dll .OldZwProtectVirtualMemory is supplied by findUnresolved, a pattern-matching algorithm that searches backward from ZwPulseEvent looking for ZwProtectVirtualMemory.

The hook function called from DriverEntry of Ghost.c was also renamed HookKernel() because there are now two forms of hooking: kernel hooking and user hooking:

  // Add kernel hooks if( !NT_SUCCESS( HookKernel() ) ) {  DbgPrint("comint32: HookKernel failed!\n");  return STATUS_UNSUCCESSFUL; }