[new feature] Implements EDR minifilter callbacks detection and removal

Co-authored-by: Windy Bug <139051196+0mWindyBug@users.noreply.github.com>

Offsets/ExtractOffsets.py

@@ -17,7 +17,7 @@ THREADS_LIMIT = None
 CSVLock = threading.Lock()
 
 machineType = dict(x86=332, x64=34404)
-supported_images = ["ntoskrnl.exe", "wdigest.dll", "ci.dll"]
+supported_images = ["ntoskrnl.exe", "wdigest.dll", "ci.dll", "fltmgr.sys"]
 modes = [image_name.split(".")[0] for image_name in supported_images]
 extensions_by_mode = dict(image_name.split(".") for image_name in supported_images)
 known_image_versions = {mode: list() for mode in modes}
@@ -46,6 +46,19 @@ symbols = dict(
         ("g_CiOptions", "symbol"),
         ("CiValidateImageHeader", "symbol"),
     ],
+    fltmgr=[
+        ("FltGlobals", "symbol"),
+        ("_GLOBALS", "FrameList", "field"),
+        ("_FLT_RESOURCE_LIST_HEAD", "rList", "field"),
+        ("_FLTP_FRAME", "Links", "field"),
+        ("_FLTP_FRAME", "RegisteredFilters", "field"),
+        ("_FLT_OBJECT", "PrimaryLink", "field"),
+        ("_FLT_FILTER", "DriverObject", "field"),
+        ("_FLT_FILTER", "InstanceList", "field"),
+        ("_DRIVER_OBJECT", "DriverInit", "field"),
+        ("_FLT_INSTANCE", "CallbackNodes", "field"),
+        ("_FLT_INSTANCE", "FilterLink", "field"),
+    ],
 )
 
 symbols_names = {mode: [t[0] if t[-1] == "symbol" else f"{t[0]}_{t[1]}" for t in symbols[mode]] for mode in modes}