Dont' forget about MmGetSystemRoutineAddress routine
Of couse if it works only for routines exported by ntoskrnl or HAL.. But in some cases it's enough.
Here is a plan how to make simple native encryptor
Very common.
1) Get some user mode PE encryptor\compressor sources (better in asm)
2) Change GetProcAddress to MmGetSystemRoutineAddress
3) Change VirtualAlloc\VirtualFree to ExAllocatePool\ExFreePool
4) Debug
P.S. Classical compression based on possibility of making VirualSize of PE section bigger than PhisicalSize will work only in case Section alignment= 1000, File alignment= 200. Any other combination does'nt work for me.
Anyway compression in drivers it's not a good idea coz memory in pool is very
valuable resource.