[Compuware Corporation] [Compuware NuMega home page]                [NuMega Lab]
[teal]

 [DriverStudio]    [Image][Image]
  · Home
 [Driver Products]        Driver Technical Tips
  · DriverStudio          Notes on Unloading NT 4.0 Kernel Mode Drivers
  · DriverBundle
  · Previews              While NT4.0 is not a true "Plug and Play" operating
  · Compatibility         system, it does allow kernel mode drivers to be
 [Downloads]  ·           dynamically loaded and unloaded while the system is
                          running. The Service Control Manager is generally
 Wizards                  responsible for directing the load and unload
  · Utilities             operations, as we discussed in an earlier tip on
  · NT source             Driver Security Basics.
 examples
  · VxD source            A kernel mode driver can load a driver by calling the
 examples                 undocumented system service ZwLoadDriver. This takes
  · WDM source            a single parameter, namely a PUNICODE_STRING that
 examples                 points to the pathname of the driver's key under
 [Resources]  ·           \HKLM\System\CurrentControlSet\Services. To unload a
 Technical papers         driver loaded by this service, a kernel mode driver
  · Useful links          can call ZwUnloadDriver with the same parameter. The
  · Technical tips        usual caveats about calling undocumented services
 [Support]  ·             apply.
 Support                  Strangely, Windows 98 supports ZwLoadDriver, but not
  · Knowledge base        ZwUnloadDriver.
  · Problem
 submission               Occasionally a driver enters a state where it is
  · Product               dangerous or undesirable to unload the driver.
 registration             Although system maintains reference counts to prevent
  · Release notes         a driver that owns device objects with open handles
 [Shop NuMega]  ·         from being unloaded, the driver itself can take
 Buy it!                  action to prevent this from happening. All you need
  · Price list            to do is zero out data member DriverUnload in the
  · How to buy            driver's DRIVER_OBJECT (which is passed in to
  · Sales offices         DriverEntry). Normally, this location holds the
                          address of the unload function, but if zero, the
                          driver cannot be unloaded. If necessary, a driver can
 [Y2K Compliance]         set this value dynamically during the execution of
                          the driver to control when the driver is unloadable.

 [More information]       If you're using DriverWorks, you can call KDriver
                          members EnableUnload and DisableUnload to achieve the
                          same effect.

                          Back to technical tip start page.

  DriverCentral · DriverStudio · Free downloads · Resources · Support and
                          Services · Shop NuMega
     Compuware NuMega · Tel: +1 603 578-8400 · Updated: 9 August 1999 ·
                      Problems? Contact our webmaster.