Write a small piece of code responsible for creating and removing a system service for a given vulnerable driver (ex. RTCore64.sys).
Tip #1: use CreateServiceA()
function.
Tip #2: look into a MSDN sample
Note: similar code was presented in one of the RTO: Privilege Escalation modules and also in this RTO: Persistence module.
Once completed, consider creating/removing system service via direct registry changes, without using high-level Windows Service API.
Tip #3: look into manual registry editing in MSDN example and create an equivalent code snippet for that.