Device Manager lists the physical address of the framebuffer under
Display Adapters > Resources, which you can pass to MmMapIoSpace to get
the nonpaged virtual address. You can draw directly on the framebuffer
using that address like /dev/fb0
If you want to create a window-relative framebuffer then you necessarily
have to go through the Window's API to request it before drawing, the
simplest way seems to be using BitBlt to draw a bitmap after requesting
a device context handle: https://solhsa.com/wintut/ch3.html