Can we trap driver unload ?

Hi,

Is there any way by which a driver can find out other driver/s is unloaded
?
More precisely can driver trap unload event ?
How does windows kernel come to know about driver unload ?

Thanks,
-Ulka

I think Ps notify callbacks can help you.

Good old TrueCrypt was using Ps notify callback to catch the driver binary load notification, to hook the DriverEntry of the just-loaded binary to implement crash/hiber dump filtering.

So, I expect Ps delete callbacks to also work for a driver binary.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com
“Ulka Vaze” wrote in message news:xxxxx@ntdev…
Hi,

Is there any way by which a driver can find out other driver/s is unloaded ?

More precisely can driver trap unload event ?

How does windows kernel come to know about driver unload ?

Thanks,

-Ulka