when i create a driver and a device object like this:
PDRIVER_OBJECT fakeDriverObj;
OBJECT_ATTRIBUTES DrvAttribute;
InitializeObjectAttributes(&DrvAttribute,
&dr0Device->DriverObject->DriverName,
OBJ_PERMANENT| OBJ_CASE_INSENSITIVE| OBJ_KERNEL_HANDLE,
NULL,
NULL);
auto fakeDriverObjSize = sizeof(DRIVER_OBJECT) + sizeof(EXTENDED_DRIVER_EXTENSION);
NT_ASSERT(*IoDriverObjectType);
status = ObCreateObject(KernelMode,
*IoDriverObjectType,
&DrvAttribute,
KernelMode,
NULL,
fakeDriverObjSize,
0,
0,
reinterpret_cast<PVOID*>(&fakeDriverObj));
memcpy(fakeDriverObj, dr0Device->DriverObject, fakeDriverObjSize);
dr0Device is a real device from a real driver, and i associate the created device to the created driver like this :
fakeDeviceObj->DriverObject = fakeDriverObj;
fakeDriverObj->DeviceObject = fakeDeviceObj;
is this even valid ? i mean when i do this :
g_originalDeviceControle = fakeDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL];
calling g_originalDeviceControle() will be like calling the original driver ?