Fw: Registry related operations in Driver Unload

NTDEV
1

HI,

I am writing a sample disk filter driver. can I do registry related operations in the driver unload. I could not debug the driver unload routine for some wired reason ,so I could not confirm the same, can some one please help me confirm this ?

regards,
Vijay

2

Yes. Unload is invoked at passive level. Not being able to debug your
unload routine indicates a malfunction of your debugging environment
or your build process. For example, you may not actually have an
unload routine even though you think you do. Debug prints help for
situations like this.

Mark Roddy

On Mon, Aug 10, 2009 at 6:37 AM, Vijay Pothireddy wrote:
>
>
>
> HI,
>
> I am writing a sample disk filter driver. can I do registry related
> operations in the driver unload. I could not debug the driver unload routine
> for some wired reason ,so I could not confirm the same, can some one please
> help me confirm this ?
>
>
> regards,
> Vijay
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

3

So you mean to say I can access registry data at the driver unload.
and I debugging the host presented in the vmware work station 5.5 and the
host os windows 2003 x86

I have placed Dbgprint in the Unload module, I could not see the prints in
the debugger.

my driver entry will look like some thing below :

NTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING
RegistryPath )
{

WDF_DRIVER_CONFIG config;
NTSTATUS status;
WDF_OBJECT_ATTRIBUTES attributes;

WDF_DRIVER_CONFIG_INIT(&config,XXXFltrEvtDeviceAdd);

XXXDriverObject = DriverObject;

config.EvtDriverUnload = DriverUnload;
attributes.EvtCleanupCallback = XXXDriverContextCleanup;
WDF_OBJECT_ATTRIBUTES_INIT(&attributes);

status = WdfDriverCreate(DriverObject,
RegistryPath,
&attributes,
&config,
WDF_NO_HANDLE);

DbgPrint(“%s”,“Driver Load is sucess”);
return STATUS_SUCCESS;

}

From: “Mark Roddy”
> Sent: Tuesday, August 11, 2009 7:09 PM
> To: “Windows System Software Devs Interest List”
> Subject: Re: [ntdev] Fw: Registry related operations in Driver Unload
>
>> Yes. Unload is invoked at passive level. Not being able to debug your
>> unload routine indicates a malfunction of your debugging environment
>> or your build process. For example, you may not actually have an
>> unload routine even though you think you do. Debug prints help for
>> situations like this.
>>
>> Mark Roddy
>>
>>
>>
>> On Mon, Aug 10, 2009 at 6:37 AM, Vijay Pothireddy
>> wrote:
>>>
>>>
>>>
>>> HI,
>>>
>>> I am writing a sample disk filter driver. can I do registry related
>>> operations in the driver unload. I could not debug the driver unload
>>> routine
>>> for some wired reason ,so I could not confirm the same, can some one
>>> please
>>> help me confirm this ?
>>>
>>>
>>> regards,
>>> Vijay
>>>
>>> —
>>> NTDEV is sponsored by OSR
>>>
>>> For our schedule of WDF, WDM, debugging and other seminars visit:
>>> http://www.osr.com/seminars
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>

4

not sure whether you can access registry data during unload…

but i have seen that during bootup you can access only some parts of regsitry…but all of them…(only boot specific hives to be precise…)

Not sure whether the same thin happens during unload…

5

> but i have seen that during bootup you can access only some parts of regsitry…but all of them…(only

SYSTEM only.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com