Trying to prevent PnP driver from auto-loading during driver development?

NTDEV
1

Hi. I’ve worked in Linux kernel space for years but recently I’ve been tasked with porting one of our Linux drivers to Win2k8 R2. I’m still coming up to speed with WDM/WDF so please forgive if I’m asking a dumb question:

What’s the recommended way of loading a driver while in early development? When you have a critical bug in your DeviceAdd event callback or IRP_MN_START_DEVICE handler that results in a kernel crash, how does one typically proceed?

Here’s my situation: INF file specifies SERVICE_DEMAND_START, used devcon to load the driver. Bug in DeviceAdd caused a crash. Tell WinDBG to reboot the target machine. Unfortunately, the PnP manager on the target machine still sees the PCIe device so it proceeds to automatically load the device driver which results in the same crash again. Rinse and repeat.

So far, the only workaround I’ve found is to power-down the target machine, remove the PCIe device, boot the target machine (now the PnP manager won’t invoke the offending DeviceAdd routine), manually delete the driver, power-down the target machine, reinstall the PCIe device, boot the target machine and then install the fixed driver. Seems awfully tedious.

Is there a way to make the PnP manager *not* automatically load a device driver even if it sees a matching piece of hardware on the bus? I thought perhaps specifying SERVICE_DISABLED in the INF would allow me to manually start the driver (perhaps via ‘net use’ or CreateService/StartService API routines from userspace) but alas devcon refuses to even install such a driver.

So…What do seasoned Windows driver gurus do during early driver development when drivers are very crash-prone? Surely there’s a more efficient way than what I’m doing?

Thanks for any advice
J

2

Since your driver is not boot-start type, you can use .kdfiles command of the debugger to push an updated driver through the debugger connection, when the driver is loaded. The updated driver will also replace the old one on the disk, which is not always desirable, but that’s what it is.

A difficult part of .kdfiles is that you have to specify exact driver image path as used by the driver loader. It may come in different forms.

3

Thanks. I’ll take a look into .kdfiles. It never occurred to me that the kernel debugger might provide a means of updating the .sys file. Guess I should have read the Debugging Tools help files more closely. Thanks again.

4

.kdfiles does NOT replace the .sys image on the target machine. Once you log in, you will need to copy over the new file if you want to stop using .kdfiles.

d

dent from a phine with no keynoard

-----Original Message-----
From: xxxxx@gmail.com
Sent: Tuesday, March 29, 2011 7:26 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during driver development?

Thanks. I’ll take a look into .kdfiles. It never occurred to me that the kernel debugger might provide a means of updating the .sys file. Guess I should have read the Debugging Tools help files more closely. Thanks again.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Mostly, I use .kdfiles for such scenarios.

But since it is a non-boot start driver, there are other mechanisms also

Declare some globals (only for dev work), put checks for that global at
appropriate places (say in DriverEntry, AddDevice, MN_START_HANDLER) and if
variables set, do necessary cleanup if required and return UNSUCCESSFUL or
some error status so that which faulty code execution would not be possible.

e.g, Declare global g_ReturnErrorInDriverEntry. If you don’t want your
driver to be loaded, put a bp on DriverEntry, set this global value to true,
Your DriverEntry should check for this value if it is true, it should return
error status and you are done.

Since this is just for dev phase only, you can put a bp at the end of
function also and just modify status value to some error status, it will do
the trick, however resources that has been held up wont be cleaned up until
the reboot.

Above mentioned tricks will not work on drivers which are boot start,
because non-functioning of these drivers will prevent the system to bootup
and you will get a bugcheck.

-Deepak

On Tue, Mar 29, 2011 at 7:29 PM, wrote:

> Hi. I’ve worked in Linux kernel space for years but recently I’ve been
> tasked with porting one of our Linux drivers to Win2k8 R2. I’m still coming
> up to speed with WDM/WDF so please forgive if I’m asking a dumb question:
>
> What’s the recommended way of loading a driver while in early development?
> When you have a critical bug in your DeviceAdd event callback or
> IRP_MN_START_DEVICE handler that results in a kernel crash, how does one
> typically proceed?
>
> Here’s my situation: INF file specifies SERVICE_DEMAND_START, used devcon
> to load the driver. Bug in DeviceAdd caused a crash. Tell WinDBG to reboot
> the target machine. Unfortunately, the PnP manager on the target machine
> still sees the PCIe device so it proceeds to automatically load the device
> driver which results in the same crash again. Rinse and repeat.
>
> So far, the only workaround I’ve found is to power-down the target machine,
> remove the PCIe device, boot the target machine (now the PnP manager won’t
> invoke the offending DeviceAdd routine), manually delete the driver,
> power-down the target machine, reinstall the PCIe device, boot the target
> machine and then install the fixed driver. Seems awfully tedious.
>
> Is there a way to make the PnP manager not automatically load a device
> driver even if it sees a matching piece of hardware on the bus? I thought
> perhaps specifying SERVICE_DISABLED in the INF would allow me to manually
> start the driver (perhaps via ‘net use’ or CreateService/StartService API
> routines from userspace) but alas devcon refuses to even install such a
> driver.
>
> So…What do seasoned Windows driver gurus do during early driver
> development when drivers are very crash-prone? Surely there’s a more
> efficient way than what I’m doing?
>
> Thanks for any advice
> J
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

6

Actually, you should be able to use .kdfiles for boot start drivers as of win7/srv08 r2, should you enable boot debugging (bcdedit /set bootdebug on).

This (kdfiles) is the solution I’d recommend. Other options are to set a breakpoint on DriverEntry for your driver and patch it to return STATUS_UNSUCCESSFUL in the kernel debugger.

  • S

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@broadcom.com
Sent: Tuesday, March 29, 2011 7:08 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during driver development?

Since your driver is not boot-start type, you can use .kdfiles command of the debugger to push an updated driver through the debugger connection, when the driver is loaded. The updated driver will also replace the old one on the disk, which is not always desirable, but that’s what it is.

A difficult part of .kdfiles is that you have to specify exact driver image path as used by the driver loader. It may come in different forms.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

7

You can also play this sort of game with a registry value to which you write
some sentinel value upon successful unload/shutdown/whatever you want. If
the value is not there/incorrect, you fail/do whatever you wish during load.
Of course, if you need this device to

run, this won’t help.

While this sounds useful, in practice, I find that .kdfiles is the way to go
in most cases.

Good luck,

mm

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Deepak Gupta
Sent: Tuesday, March 29, 2011 10:46 AM
To: Windows System Software Devs Interest List
Cc: xxxxx@gmail.com
Subject: Re: [ntdev] Trying to prevent PnP driver from auto-loading during
driver development?

Mostly, I use .kdfiles for such scenarios.

But since it is a non-boot start driver, there are other mechanisms also

Declare some globals (only for dev work), put checks for that global at
appropriate places (say in DriverEntry, AddDevice, MN_START_HANDLER) and if
variables set, do necessary cleanup if required and return UNSUCCESSFUL or
some error status so that which faulty code execution would not be possible.

e.g, Declare global g_ReturnErrorInDriverEntry. If you don’t want your
driver to be loaded, put a bp on DriverEntry, set this global value to true,
Your DriverEntry should check for this value if it is true, it should return
error status and you are done.

Since this is just for dev phase only, you can put a bp at the end of
function also and just modify status value to some error status, it will do
the trick, however resources that has been held up wont be cleaned up until
the reboot.

Above mentioned tricks will not work on drivers which are boot start,
because non-functioning of these drivers will prevent the system to bootup
and you will get a bugcheck.

-Deepak

On Tue, Mar 29, 2011 at 7:29 PM, wrote:

Hi. I’ve worked in Linux kernel space for years but recently I’ve been
tasked with porting one of our Linux drivers to Win2k8 R2. I’m still coming
up to speed with WDM/WDF so please forgive if I’m asking a dumb question:

What’s the recommended way of loading a driver while in early development?
When you have a critical bug in your DeviceAdd event callback or
IRP_MN_START_DEVICE handler that results in a kernel crash, how does one
typically proceed?

Here’s my situation: INF file specifies SERVICE_DEMAND_START, used devcon
to load the driver. Bug in DeviceAdd caused a crash. Tell WinDBG to reboot
the target machine. Unfortunately, the PnP manager on the target machine
still sees the PCIe device so it proceeds to automatically load the device
driver which results in the same crash again. Rinse and repeat.

So far, the only workaround I’ve found is to power-down the target machine,
remove the PCIe device, boot the target machine (now the PnP manager won’t
invoke the offending DeviceAdd routine), manually delete the driver,
power-down the target machine, reinstall the PCIe device, boot the target
machine and then install the fixed driver. Seems awfully tedious.

Is there a way to make the PnP manager not automatically load a device
driver even if it sees a matching piece of hardware on the bus? I thought
perhaps specifying SERVICE_DISABLED in the INF would allow me to manually
start the driver (perhaps via ‘net use’ or CreateService/StartService API
routines from userspace) but alas devcon refuses to even install such a
driver.

So…What do seasoned Windows driver gurus do during early driver
development when drivers are very crash-prone? Surely there’s a more
efficient way than what I’m doing?

Thanks for any advice
J

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

8

> -----Original Message-----

From: xxxxx@lists.osr.com [mailto:bounce-447161-
xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, March 29, 2011 8:29 AM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] Trying to prevent PnP driver from auto-loading
during driver development?

.kdfiles does NOT replace the .sys image on the target machine. Once
you log in, you will need to copy over the new file if you want to stop
using .kdfiles.

Sorry D, but I believe you’re mistaken, at least in XP and Win7, on both of
which I have used .kdfiles extensively, and other than the occasional
failure to write the image file, which results in the driver not being
replaced at all, it has always replaced the image on the disk. One possible
exception, which I have had no reason to test, is in loading a replacement
for something shipped with the OS, such as FastFat. I can’t say that would
be replaced on the disk with the confidence that I can my own drivers, both
software-only and device drivers.

Phil

Philip D. Barila (303) 776-1264

9

My memory fails me I guess :D. I haven’t used this command in a couple of years …

d

dent from a phine with no keynoard

-----Original Message-----
From: Philip D Barila
Sent: Tuesday, March 29, 2011 8:47 AM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] Trying to prevent PnP driver from auto-loading during driver development?

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-447161-
xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, March 29, 2011 8:29 AM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] Trying to prevent PnP driver from auto-loading
during driver development?

.kdfiles does NOT replace the .sys image on the target machine. Once
you log in, you will need to copy over the new file if you want to stop
using .kdfiles.

Sorry D, but I believe you’re mistaken, at least in XP and Win7, on both of
which I have used .kdfiles extensively, and other than the occasional
failure to write the image file, which results in the driver not being
replaced at all, it has always replaced the image on the disk. One possible
exception, which I have had no reason to test, is in loading a replacement
for something shipped with the OS, such as FastFat. I can’t say that would
be replaced on the disk with the confidence that I can my own drivers, both
software-only and device drivers.

Phil

Philip D. Barila (303) 776-1264

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

10

seriously?

I have never seen .kdfiles for boot start devices work. I have heard
rumors that some people at some point in time have had it work on some
platform, but I have always discounted that as either an urban legend
or an inside the redmond bubble artifact.

Mark Roddy

On Tue, Mar 29, 2011 at 10:50 AM, Skywing wrote:
> Actually, you should be able to use .kdfiles for boot start drivers as of win7/srv08 r2, should you enable boot debugging (bcdedit /set bootdebug on).
>
> This (kdfiles) is the solution I’d recommend. ?Other options are to set a breakpoint on DriverEntry for your driver and patch it to return STATUS_UNSUCCESSFUL in the kernel debugger.
>
> - S
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@broadcom.com
> Sent: Tuesday, March 29, 2011 7:08 AM
> To: Windows System Software Devs Interest List
> Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during driver development?
>
> Since your driver is not boot-start type, you can use .kdfiles command of the debugger to push an updated driver through the debugger connection, when the driver is loaded. The updated driver will also replace the old one on the disk, which is not always desirable, but that’s what it is.
>
> A difficult part of .kdfiles is that you have to specify exact driver image path as used by the driver loader. It may come in different forms.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>

11

I have been using it with checked ntldr though never tried on win7/2k8r2
with bootdebug on.

-Deepak

On Tue, Mar 29, 2011 at 9:30 PM, Mark Roddy wrote:

> seriously?
>
> I have never seen .kdfiles for boot start devices work. I have heard
> rumors that some people at some point in time have had it work on some
> platform, but I have always discounted that as either an urban legend
> or an inside the redmond bubble artifact.
>
> Mark Roddy
>
>
>
> On Tue, Mar 29, 2011 at 10:50 AM, Skywing
> wrote:
> > Actually, you should be able to use .kdfiles for boot start drivers as of
> win7/srv08 r2, should you enable boot debugging (bcdedit /set bootdebug on).
> >
> > This (kdfiles) is the solution I’d recommend. Other options are to set a
> breakpoint on DriverEntry for your driver and patch it to return
> STATUS_UNSUCCESSFUL in the kernel debugger.
> >
> > - S
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] On Behalf Of xxxxx@broadcom.com
> > Sent: Tuesday, March 29, 2011 7:08 AM
> > To: Windows System Software Devs Interest List
> > Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during
> driver development?
> >
> > Since your driver is not boot-start type, you can use .kdfiles command of
> the debugger to push an updated driver through the debugger connection, when
> the driver is loaded. The updated driver will also replace the old one on
> the disk, which is not always desirable, but that’s what it is.
> >
> > A difficult part of .kdfiles is that you have to specify exact driver
> image path as used by the driver loader. It may come in different forms.
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
> >
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

12

xxxxx@gmail.com wrote:

Hi. I’ve worked in Linux kernel space for years but recently I’ve been tasked with porting one of our Linux drivers to Win2k8 R2. I’m still coming up to speed with WDM/WDF so please forgive if I’m asking a dumb question:

What’s the recommended way of loading a driver while in early development? When you have a critical bug in your DeviceAdd event callback or IRP_MN_START_DEVICE handler that results in a kernel crash, how does one typically proceed?

One answer is to add code in your DriverEntry routine to rename the
extension on your .sys file, or even delete the file. That way, when
you reboot, the file won’t exist. Although that seems slimy, I have
found it to be a time-saver in cases like this.

Here’s my situation: INF file specifies SERVICE_DEMAND_START, used devcon to load the driver.

Exactly how did you use “devcon” to load the driver? One caution:
“devcon install” does not do what you think it does. It creates a fake,
non-hardware device, and loads your driver to handle it. That often
results in disaster if the driver expects to talk to real hardware. If
you did “devcon dp_add”, then you are in good shape.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

13

I can report that it works for me on win7, x64, chk/fre, at least, and not
any flavor of Vista/S2K8(R1) that I ever tried. I got it to work once on
some variation of XP, a long time ago, but that involved a lot of trial,
error and begging, the only part of which I really recall is that the
instructions in the windbg docs/wdk docs aren’t correct, at least that I
could determine, about using the the version of ntldr that comes with the
wdk - I had to use one from a legit CHK distribution.

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Tuesday, March 29, 2011 12:01 PM
To: Windows System Software Devs Interest List
Cc: Skywing
Subject: Re: RE:[ntdev] Trying to prevent PnP driver from auto-loading
during driver development?

seriously?

I have never seen .kdfiles for boot start devices work. I have heard
rumors that some people at some point in time have had it work on some
platform, but I have always discounted that as either an urban legend
or an inside the redmond bubble artifact.

Mark Roddy

On Tue, Mar 29, 2011 at 10:50 AM, Skywing
wrote:
> Actually, you should be able to use .kdfiles for boot start drivers as of
win7/srv08 r2, should you enable boot debugging (bcdedit /set bootdebug on).
>
> This (kdfiles) is the solution I’d recommend. ?Other options are to set a
breakpoint on DriverEntry for your driver and patch it to return
STATUS_UNSUCCESSFUL in the kernel debugger.
>
> - S
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@broadcom.com
> Sent: Tuesday, March 29, 2011 7:08 AM
> To: Windows System Software Devs Interest List
> Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during
driver development?
>
> Since your driver is not boot-start type, you can use .kdfiles command of
the debugger to push an updated driver through the debugger connection, when
the driver is loaded. The updated driver will also replace the old one on
the disk, which is not always desirable, but that’s what it is.
>
> A difficult part of .kdfiles is that you have to specify exact driver
image path as used by the driver loader. It may come in different forms.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
>

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

14

“One possible
exception, which I have had no reason to test, is in loading a replacement
for something shipped with the OS, such as FastFat.”

.kdfiles only takes effect when the image is actually in the process of being loaded. FastFat I guess is boot-load type, so you may not get a chance to intercept its load. Also, system file protection may kick in and replace it back at once.

15

Oddly enough, I used .kdfiles with fastfat a few weeks ago, and you can
intercept it. It seems to be demand start on Win7 at least, but I don’t
think that the start type works as it normally does for other types of
drivers, at least to the extent that you can disable them and they will
still load if required. On Win7 at least, .kdfiles will overwrite it, and
there’s no SFP to replace it. I don’t know what the deal is with XP, et. c.

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@broadcom.com
Sent: Tuesday, March 29, 2011 1:48 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during
driver development?

“One possible
exception, which I have had no reason to test, is in loading a replacement
for something shipped with the OS, such as FastFat.”

.kdfiles only takes effect when the image is actually in the process of
being loaded. FastFat I guess is boot-load type, so you may not get a chance
to intercept its load. Also, system file protection may kick in and replace
it back at once.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

16

> What’s the recommended way of loading a driver while in early development? When you have a critical bug in

your DeviceAdd event callback or IRP_MN_START_DEVICE handler that results in a kernel crash, how does
one typically proceed?

If you use KMDF, then MN_START_DEVICE is done by the framework.

And, if you have a crash in these path, then you have a dump and analyze it. Better to re-read these paths before testing.

target machine still sees the PCIe device so it proceeds to automatically load the device driver

  1. Set Load Module event in WinDbg
  2. when your module is loaded, use “a” command and enter the following to DriverEntry of your module:
    mov eax, c0000001
    ret 8

Then, when the machine is booted, replace the .sys file with the one with bug fixed.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

17

>type, so you may not get a chance to intercept its load. Also, system file protection may kick in and replace it back

Not on Vista+

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

18

Here’s a little snippet : http://pastie.org/1732901

Add some magic value in the service key of the driver (in my snippet, DEBUG). The first thing in DriverEntry, try to delete it. If it was not present, DriverEntry bails out.
Every time you want to re-run the driver, add the value again.

Regards,
–pa

19

If you pull the file via kd over the boot debugger (in winload), the file isn’t replaced on disk.
If you pull the file via kd over the kernel debugger (in ntos), the file *is* replaced on disk.

Only boot start files are pulled via the boot debugger, and only then if you enable boot debugging (bcdedit /set bootdebug on).

As far as I can see, the behavior has been to replace the file on disk when pulling over the kernel debugger for many releases now (at least back to XP).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Martin O’Brien
Sent: Tuesday, March 29, 2011 11:25 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Trying to prevent PnP driver from auto-loading during driver development?

Oddly enough, I used .kdfiles with fastfat a few weeks ago, and you can intercept it. It seems to be demand start on Win7 at least, but I don’t think that the start type works as it normally does for other types of drivers, at least to the extent that you can disable them and they will still load if required. On Win7 at least, .kdfiles will overwrite it, and there’s no SFP to replace it. I don’t know what the deal is with XP, et. c.

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@broadcom.com
Sent: Tuesday, March 29, 2011 1:48 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during driver development?

“One possible
exception, which I have had no reason to test, is in loading a replacement for something shipped with the OS, such as FastFat.”

.kdfiles only takes effect when the image is actually in the process of being loaded. FastFat I guess is boot-load type, so you may not get a chance to intercept its load. Also, system file protection may kick in and replace it back at once.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

20

I wasn’t clear, but that would be consistent with what I saw - most
recently, I wasn’t loading fastfat.sys at boot (although I had previously).

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Skywing
Sent: Tuesday, March 29, 2011 6:43 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Trying to prevent PnP driver from auto-loading during
driver development?

If you pull the file via kd over the boot debugger (in winload), the file
isn’t replaced on disk.
If you pull the file via kd over the kernel debugger (in ntos), the file
*is* replaced on disk.

Only boot start files are pulled via the boot debugger, and only then if you
enable boot debugging (bcdedit /set bootdebug on).

As far as I can see, the behavior has been to replace the file on disk when
pulling over the kernel debugger for many releases now (at least back to
XP).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Martin O’Brien
Sent: Tuesday, March 29, 2011 11:25 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Trying to prevent PnP driver from auto-loading during
driver development?

Oddly enough, I used .kdfiles with fastfat a few weeks ago, and you can
intercept it. It seems to be demand start on Win7 at least, but I don’t
think that the start type works as it normally does for other types of
drivers, at least to the extent that you can disable them and they will
still load if required. On Win7 at least, .kdfiles will overwrite it, and
there’s no SFP to replace it. I don’t know what the deal is with XP, et. c.

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@broadcom.com
Sent: Tuesday, March 29, 2011 1:48 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Trying to prevent PnP driver from auto-loading during
driver development?

“One possible
exception, which I have had no reason to test, is in loading a replacement
for something shipped with the OS, such as FastFat.”

.kdfiles only takes effect when the image is actually in the process of
being loaded. FastFat I guess is boot-load type, so you may not get a chance
to intercept its load. Also, system file protection may kick in and replace
it back at once.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer