Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


[Slightly OT] Can't load my WDM driver under 98.

OSR_Community_UserOSR_Community_User Member Posts: 110,217
I have a WDM driver that loads and works fine under Windows 2000. Under
Windows 98, however, I get an error 192 from the Add Hardware Wizard during
Plug and Play installation which, intepreted as a Win32 error code, means
ERROR_EXE_MARKED_INVALID.

My driver binary is normally marked for Windows 4.10, subsystem 1.0 and has
the WDM flag set in the 'DllCharacterics' field in the PE headers. I've
tried other variations, but this makes no difference.

Anyway, if I attempt to load the driver explicitly from a helper VxD using
NtKernLoadDriver(), I get back 0xC00000034. This is of course an NTSTATUS
value which means STATUS_OBJECT_NAME_NOT_FOUND (although I would have
expected STATUS_INVALID_IMAGE_FORMAT or something more consistent with my
interpretation of error 192 above).

Also, if I attempt to simply load the "raw" image directly via
PELDR_LoadModule(), this succeeds! The documentation says that
PELDR_LoadModule() "loads a portable executable, performs relocation fixups
and resolves imports" so, apparently, my driver binary can't really be
*that* invalid if all this can occur without error?!

Note that PELDR_LoadModule() failed originally, but I tracked the problem
down to having imported some non-existent functions under 98. I fixed that
and then I could successfully load (and unload) the driver image using
PELDR.

So, having fixed the invalid imports, I'm having trouble making sense out of
the STATUS_OBJECT_NAME_NOT_FOUND result I'm receiving from
NtKernLoadDriver(). *What* can't it find? I don't think I'm importing
anything that doesn't exist under 98 and I believe I have set things up
properly for calling NtKernLoadDriver().

That is, I have created a registry key
"HKLM\System\CurrentControlSet\Services\MyDriver" containing an "ImagePath"
string value (all modelled after some existing entries I found there) and am
passing the string "MyDriver" to NtKernLoadDriver() as a UNICODE_STRING. My
driver file is at the location specified by "ImagePath" (the same place, in
fact, that PELDR_LoadModule() is able to load it from). Am I missing
something else?

Has anyone else ever used NtKernLoadDriver() to successfully load a WDM
driver under Windows 98? I know doing so doesn't load a "true" WDM driver,
but I'd still like to verify that this works so I'll know my driver image is
valid and that the Wizard is having some other problem.

- Matt
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 January 2023 Live, Online
Developing Minifilters 20 March 2023 Live, Online
Internals & Software Drivers 17 April 2023 Live, Online
Writing WDF Drivers 22 May 2023 Live, Online