How did you install this driver?
Take a look at ImagePath value in your registry path. If this field is
like ??\c:\windows\system32\driver\mydriver.sys and your driver start
too early, like “Boot Start”, the system won’t be able to find it.
s,
Fernando Roberto da Silva
DriverEntry Kernel Development
http://www.driverentry.com.br
-----Mensagem original-----
De: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] Em nome de
xxxxx@yahoo.com
Enviada em: quarta-feira, 4 de julho de 2007 07:22
Para: Windows System Software Devs Interest List
Assunto: RE:[ntdev] Problem with unloading driver.
I am properly loading and unloading the driver but nest time when I
install the driver and attempt to start driver is fails with error 0X2
ie. file not found.
Can anyone tell me what is the problem.
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
>I am properly loading and unloading the driver but nest time when I install the
driver and attempt to start driver is fails with error 0X2 ie. file not found.
Can anyone tell me what is the problem.
It looks like you have just failed to clean up properly in Unload() routine - in this context “File not found” error has nohing to do with failure to find a file. This happened to me quite a few times as well… .
Anton Bassov
Hi All,
I have loaded my driver using SCM functions. It gets loaded properly but when I un unload it it’s Unload Driver get called but the image of driver remains loaded in memory as result whan I enumarate loaded drivers it shows my driver. why it does not get unloaded?
Thanks & Regards,
Amit.
> why it does not get unloaded?
Because it either did not clean up properly, or someone keeps an outstanding reference to its driver object and/or one of its device objects…
Anton Bassov
If you fail to delete any device object that you created with IoDeleteDevice
or if any of the device objects you deleted still have outstanding
references that you or another driver created with ObReferenceObject type
functions, then those devices will not actually release from memory. The
driver object can’t release from memory until all its device objects have
released.
As a debugging method you can enumerate the device object list starting at
DriverObject->DeviceObject and getting successive devices with
DeviceObject->NextDevice if you are unsure which device may still be open.
The reference count for each device object is held in
DeviceObject->ReferenceCount. The reference count is not documented and is
meant to be touched only by ObReferenceObject and ObDereferenceObject type
functions, so don’t get the idea to just change it to zero to force an
unload. That will cause a crash almost certainly. If all the device
objects have been released then DriverObject->DeviceObject will be NULL
before DriverUnload ends the SCM will release the driver object at that time
unless you did something unorthodox like take a reference to the driver
object itself.
wrote in message news:xxxxx@ntdev…
> Hi All,
>
> I have loaded my driver using SCM functions. It gets loaded properly but
> when I un unload it it’s Unload Driver get called but the image of driver
> remains loaded in memory as result whan I enumarate loaded drivers it
> shows my driver. why it does not get unloaded?
>
> Thanks & Regards,
> Amit.
>
>The reference count for each device object is held in
DeviceObject->ReferenceCount. The reference count is not documented and is
meant to be touched only by ObReferenceObject and ObDereferenceObject type
functions
not correct. the DeviceObject is one kind of the object. each object has an
object header and an object body.there is a PointerCount field in object
header. ObReferenceObject and ObDereferenceObject only add one or subtract
one from PointerCount in object header. they are not related with
DeviceObject->ReferenceCount at all.
danny
> not correct. the DeviceObject is one kind of the object. each object has an
object header and an object body.there is a PointerCount field in object
header. ObReferenceObject and ObDereferenceObject only add one or
subtract
one from PointerCount in object header. they are not related with
DeviceObject->ReferenceCount at all.
Correct.
DeviceObject->ReferenceCount is the number of file objects referencing this DO,
and also 1 additional reference for the attached DO.
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
Ahh ok. Anyway my advice still stands that a device object will not be
released till that ReferenceCount reaches 0 and that needs to happen
naturally in the driver. You can’t just manually set it to 0 and hope to
solve your issue. It seems that the pointer count also keeps your object
from unloading. By checking out the device object list you can at least
figure out which device object has prevented your driver from unloading and
that may help you figure out what you forgot to clean up. If you clean up
all your device objects and all user applications and other drivers close
their handles, pointers and object references, then the driver will unload
properly when SCM calls DriverUnload. If not, the driver will sit in memory
indefinitely waiting for everything to release even after DriverUnload has
been called.
> not correct. the DeviceObject is one kind of the object. each object has
> an
> object header and an object body.there is a PointerCount field in object
> header. ObReferenceObject and ObDereferenceObject only add one or
>subtract
> one from PointerCount in object header. they are not related with
> DeviceObject->ReferenceCount at all.
Correct.
DeviceObject->ReferenceCount is the number of file objects referencing
this DO,
and also 1 additional reference for the attached DO.