[Compuware Corporation] [Compuware NuMega home page]                [NuMega Lab]
[teal]

 [DriverStudio]    [Image][Image]
   Home
 [Driver Products]        Driver Technical Tips
   DriverStudio          Notes on Unloading NT 4.0 Kernel Mode Drivers
   DriverBundle
   Previews              While NT4.0 is not a true "Plug and Play" operating
   Compatibility         system, it does allow kernel mode drivers to be
 [Downloads]             dynamically loaded and unloaded while the system is
                          running. The Service Control Manager is generally
 Wizards                  responsible for directing the load and unload
   Utilities             operations, as we discussed in an earlier tip on
   NT source             Driver Security Basics.
 examples
   VxD source            A kernel mode driver can load a driver by calling the
 examples                 undocumented system service ZwLoadDriver. This takes
   WDM source            a single parameter, namely a PUNICODE_STRING that
 examples                 points to the pathname of the driver's key under
 [Resources]             \HKLM\System\CurrentControlSet\Services. To unload a
 Technical papers         driver loaded by this service, a kernel mode driver
   Useful links          can call ZwUnloadDriver with the same parameter. The
   Technical tips        usual caveats about calling undocumented services
 [Support]               apply.
 Support                  Strangely, Windows 98 supports ZwLoadDriver, but not
   Knowledge base        ZwUnloadDriver.
   Problem
 submission               Occasionally a driver enters a state where it is
   Product               dangerous or undesirable to unload the driver.
 registration             Although system maintains reference counts to prevent
   Release notes         a driver that owns device objects with open handles
 [Shop NuMega]           from being unloaded, the driver itself can take
 Buy it!                  action to prevent this from happening. All you need
   Price list            to do is zero out data member DriverUnload in the
   How to buy            driver's DRIVER_OBJECT (which is passed in to
   Sales offices         DriverEntry). Normally, this location holds the
                          address of the unload function, but if zero, the
                          driver cannot be unloaded. If necessary, a driver can
 [Y2K Compliance]         set this value dynamically during the execution of
                          the driver to control when the driver is unloadable.

 [More information]       If you're using DriverWorks, you can call KDriver
                          members EnableUnload and DisableUnload to achieve the
                          same effect.

                          Back to technical tip start page.

  DriverCentral  DriverStudio  Free downloads  Resources  Support and
                          Services  Shop NuMega
     Compuware NuMega  Tel: +1 603 578-8400  Updated: 9 August 1999 
                      Problems? Contact our webmaster.
