The only method i know to break on a
DriverEntry of a rootkit driver when its loaded is to disassmble
nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on
rootkitDriverName!DriverEntry doesn't work either for some reason.
Is there any easier way to break on the rootkit driver entry? Why does
rootkitDriverName!DriverEntry not work?