KernelMode.info

You are saying cross check..again, we come to the device io control...TDL3 infect driver detection to sample code?

How this screenshot is related to heuristic detection of TDL3/4? Alex has already given you the entire Xuetr detection route.

Where do I use this routines? I don't write driver for detector. I need a example to detector driver.. Trying to tell it...

Where do I use this routines?

In driver, since to list driver/device objects you need to touch kernel memory.

I need a example to detector driver..

Copy-pasting is not welcomed. Show your work. Currently I only see nonsense screenshots with OllyDbg.

I don't write driver for detector

Then what you do?

DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING

.if I can do it != I want to sample
invoke DbgPrint, $CTA0("This is my work. ")
mov I'mProgramer, FALSE
.endif
.if I'mProgramer == FALSE
invoke DbgPrint, $CTA0(" HELP ")
.endif

mov eax, STATUS_DEVICE_CONFIGURATION_ERROR
ret

DriverEntry endp

Oh I see. Forget about TDL. You are too inexperienced for it. You should start from something simpler. And the first step should be abandon ASM as language for drivers developing. See http://www.kernelmode.info/forum/viewto ... f=14&t=374 as one of the start points. Thread has exhausted itself and closed.