How to make a driver load in the safe mode?

NTFSD
1

Hi all,

According to Mark Russinovich, in order to make a driver or service loadable
when Windows 2000 starts in the safe mode, you need to add their names to
the SafeBoot list in the registry. I tried that, but it doesn’t seem to
work. Anybody know why?

In more detail:

I have a service (FGKEY.EXE) and a kernel driver (FGUARD32.SYS) paired
together to load at Windows startup, here are their entries under the
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services key:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FGKEY]
Type=0x110
Start=2
ErrorControl=1
ImagePath=C:\PROGRA~1\WINABI~1\FOLDER~2\FGKEY.EXE
DisplayName=FGKEY
DependOnService=FGUARD32
DependOnGroup=
ObjectName=LocalSystem

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FGUARD32]
Type=1
Start=2
ErrorControl=1
ImagePath=??\C:\PROGRA~1\WINABI~1\FOLDER~2\FGUARD32.SYS
DisplayName=FGUARD32

(Note that the above entries were created by SCM, not by me). When Win2K
starts normally, both the service and the driver are loaded and work OK.

Now, to make them load in the safe mode, I’ve added the following entries:

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\FGKEY]
(Default)=Service

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\FGUARD
32.SYS]
(Default)=Driver

According to M.R. (in both the Inside Win2k book and his article in
Windows2000 Magazine), the above should make both the service and the driver
loadable in the safe mode as well. However, that doesn’t happen (but they
continue to load OK in the normal mode).

Did anybody try this before or have a suggestion?

Thanks a lot in advance!

Andrei Belogortseff
WinAbility(r) Corporation [http://www.winability.com/]
“Useful Windows Utilities and Security Software”

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Nevermind, I’ve figured it out :slight_smile:

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

From: “Rob Fuller”
> Are you going to share the solution with the list?

Sure, if anyone is interested :slight_smile:

The reason for the problem with my service+driver combination turned out to
be the dependence of the service on the driver. After I’ve removed the
DependOnService=FGUARD32 entry from the Service\FGKEY key in the registry,
both the service and driver started to load in the safe mode. So Mark
Russinovich was right (as always :slight_smile: )

I hope this helps someone.

With the best wishes,

Andrei Belogortseff
WinAbility(r) Corporation [http://www.winability.com/]
“Useful Windows Utilities and Security Software”

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com