How can I make a driver wait for another driver or get notified when another driver starts?

NTDEV
21

@Tim_Roberts said:

But it seems there is no elegant way to remove this callback object when both drivers unload.

Check the docs. You use ObDereferenceObject for that.

The callback object created with OBJ_PERMANENT cannot be released with just ObDereferenceObject. It needs ZwMakeTemporaryObject as well.

But my question is, the unload order is also undecided, I am not sure two ZwMakeTemporaryObject calls are OK in this situation.

Thanks

22

@Doron_Holan said:
IoRegisterPlugPlayNotification Will let you register the callback to be notified of existing and new interface arrivals.

Yes Doron it would be nice if a vendor of that driver implemented device interface feature. It seems that for example 3 year old Intel driver doesn’t.
Intel(R) Serial IO I2C Host Controller - 9D60 driver version 30.100.1841

23

@rusakov2 said:

@Doron_Holan said:
IoRegisterPlugPlayNotification Will let you register the callback to be notified of existing and new interface arrivals.

Yes Doron it would be nice if a vendor of that driver implemented device interface feature. It seems that for example 3 year old Intel driver doesn’t.
Intel(R) Serial IO I2C Host Controller - 9D60 driver version 30.100.1841

Sometimes vendors don’t add features if they don’t need them … as @Peter has said, code that’s not written has zero bugs. If that driver doesn’t have device interfaces then there’s nothing for an attacker to try to break …

That said, I’d start looking for some IndicatorOfExistence by that driver to see if it’s “alive”; a registry entry, a named kernel object, something that you can use to detect if that driver is there or not … check when you start up, have a thread monitor that “thing” periodically … elegant? No. But it (might) work and (might) be what you have to do …