System Driver infromation as like "System Information"

NTDEV
1

How to list the set of all drivers loaded i.e the .sys files, their status, registry path etc. as like displayed in “System Information” , which is accessible from start->all programs->accessories->system tools->System Information, both from user and kernel mode.
I searched msdn website and the code that I got is only diplays the full path and driver file name.How to get the rest information?
Is there any windows API for doing the same or any undocumented or documented function that can be used.
Is there any function like user mode counterpart EnumDeviceDrivers in kernel mode?
How to use the ZwQuerySystemInformation in kernel mode and NtQuerySystemInformation in user mode to get the required result?
PsLoadImageNotifyRoutine only notifies when a image is loaded into memory but not when unloaded.Any idea how to overcome this problem?

2

Take a look at the DevCon sample in the WDK. This is a command line
equivalent of the Device Manager which is quite similar to the system
information tool.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@hotmail.com” wrote
in message news:xxxxx@ntdev:

> How to list the set of all drivers loaded i.e the .sys files, their status, registry path etc. as like displayed in “System Information” , which is accessible from start->all programs->accessories->system tools->System Information, both from user and kernel mode.
> I searched msdn website and the code that I got is only diplays the full path and driver file name.How to get the rest information?
> Is there any windows API for doing the same or any undocumented or documented function that can be used.
> Is there any function like user mode counterpart EnumDeviceDrivers in kernel mode?
> How to use the ZwQuerySystemInformation in kernel mode and NtQuerySystemInformation in user mode to get the required result?
> PsLoadImageNotifyRoutine only notifies when a image is loaded into memory but not when unloaded.Any idea how to overcome this problem?

3

> Is there any windows API for doing the same or any undocumented or documented function that can

Look at AuxKLibXxx functions.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com