Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

I need Pnp guru advice: Win2000 refuses to unload my WDM driver!

OSR_Community_UserOSR_Community_User Member Posts: 110,217

I've just gotten a WDM driver to successully load via manual installation
using the "Add/Remove Hardware Wizard" and then shut down via manual
selection of the "Uninstall" command in Device Manager under Windows 2000.

My driver's handling of AddDevice() all the way through the final
IRP_MN_REMOVE_DEVICE seems to go as expected. The Device Manager says I'm
"working properly" after installation and then correctly updates (removes my
device's icon, etc.) after the uninstall.

However, my driver's Unload() routine is not called after the uninstall
sequence is complete (after the IRP_MN_REMOVE_DEVICE returns). Instead, my
DRIVER_OBJECT is left sitting in memory always with exactly 4 references.
Isn't my driver supposed to be unloaded?

It doesn't seem my other code is somehow leaving those 4 references because
I can run through whole install/uninstall multiple times (with the never
being unloaded of course) and the final DRIVER_OBJECT reference count is
always 4.

I even tried making the Wizard install a new build of the driver, with an
updated VERSIONINFO resource, in the hopes that this would trigger Windows
to unload and "update" the driver, but it didn't. It just merrily called
the AddDevice() routine of the old (still in-memory) version of the driver.

Why won't my driver unload? Any idea where these "phantom" references might
be coming from?

- Matt
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online
Writing WDF Drivers 12 September 2022 Live, Online