Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 30 January 2023 | Live, Online |
Developing Minifilters | 20 March 2023 | Live, Online |
Internals & Software Drivers | 17 April 2023 | Live, Online |
Writing WDF Drivers | 22 May 2023 | Live, Online |
Comments
> a protocol driver.
> I have following queries
> 1. Can kernel mode drivers use calls from dlls
> 2. is there any particular difference between
> kernel mode and user mode dlls
Kernel mode DLL's is only a other word for a kernel driver
with some Export functions. Your DriverEntry function does
nothing and you exports your set of functions (with a xx.def
file). After linking this driver you have a library.
You cannot use some of user mode DLL youre are inside the
kernel in ring 0.
I think the attached html document should help you out.
Thanks,
Neelay
Only from kernel-mode DLLs, not from user-mode ones.
Also there is no GetProcAddress in kernel - only load-time linking.
> 2. is there any particular difference between
> kernel mode and user mode dlls
Kernel-mode DLL runs in kernel mode, user-mode DLL runs in user mode :-)
Kernel-mode DLL is very similar to the kernel-mode driver - but it have no
registry subkey in ...\Services. Also, once loaded, the kernel-mode DLL
cannot be unloaded, its DriverEntry is never called, and no driver object is
created for it.
scsiport.sys is a good example of kernel-mode DLL.
Note that all of the above is for NT4 - it can be wrong on w2k.
Max
Windows NT 40
Windows 98
Windows 2000
Here is no probleme. Make shure you are use only kernel API calls that exist in all OS.