Weird non-loading of driver.

NTDEV
1

As some of you probably already know, I write display drivers.

In the process of doing the next generation chips, we use a simulator, which
is a huge C++ project.

I’ve currently got a driver that runs fine using this simulator. I then
modify the C++ project using a #define, so that it has a slightly different
configurtion. This causes my driver to not load. I don’t mean not run, but
Windows XP refuses to load the driver, and when I open the control panel for
the display, it says “The display driver used for this adapter is for an
older version of Windows” (or something similar to that).

The #define basicly configures the simulated chip slightly different (the
number of internal units in a particular place), and results in a slightly
larger DLL (6.7MB instead of 6.4MB), but should not affect anything in the
display drivers actual funcationality.

I’ve spent most of today trying to figure out what’s going wrong. I had this
once earlier, and in that case it was because I was trying to call an
unsupported memory allocation routine, but I’ve checked for that, and it’s
not that.

So far I’ve checked the following (on Display Driver DLL):

  • Rebuild everything. Makes no difference, I can reliably reproduce it by
    switching the #define back and forth.
  • Imports/Exports/Dependents.
    Result: No different between working and non-working.
  • Other fields of dumpbin output.
    Result: All differences seem to be due to change in size of file,
    nothing unexpected.
  • Maximum load image size: Changed from 13 MB to 32 MB.
    Result: No difference.
  • Turn on SLS (Show Loader Snaps) in Global Flags.
    Result: Lots of extra debug messaged, but no help.
  • Turn on D32 (Kernel 32 debugging) in Global Flags.
    Result: Nothing changes. No extra output in WinDBG, and no change in
    behaviour.
  • Set event in WinDBG to catch the load of the DLL.
    Result: Failing case doesn’t see the DLL loaded. Succeeding case
    sees the DLL loaded.

Does anyone have an idea of how to discover why Windows isn’t even loading
my DLL in one case, and it’s loading just fine in another.

Thanks in advance for any advice.

–
Mats

2

Did you try using depends.exe to find missing import?

Steve
www.compuware.com\products\driverstudio

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@3Dlabs.com
Sent: Thursday, March 18, 2004 11:46 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Weird non-loading of driver.

As some of you probably already know, I write display drivers.

In the process of doing the next generation chips, we use a simulator, which
is a huge C++ project.

I’ve currently got a driver that runs fine using this simulator. I then
modify the C++ project using a #define, so that it has a slightly different
configurtion. This causes my driver to not load. I don’t mean not run, but
Windows XP refuses to load the driver, and when I open the control panel for
the display, it says “The display driver used for this adapter is for an
older version of Windows” (or something similar to that).

The #define basicly configures the simulated chip slightly different (the
number of internal units in a particular place), and results in a slightly
larger DLL (6.7MB instead of 6.4MB), but should not affect anything in the
display drivers actual funcationality.

I’ve spent most of today trying to figure out what’s going wrong. I had this
once earlier, and in that case it was because I was trying to call an
unsupported memory allocation routine, but I’ve checked for that, and it’s
not that.

So far I’ve checked the following (on Display Driver DLL):

  • Rebuild everything. Makes no difference, I can reliably reproduce it by
    switching the #define back and forth.
  • Imports/Exports/Dependents.
    Result: No different between working and non-working.
  • Other fields of dumpbin output.
    Result: All differences seem to be due to change in size of file,
    nothing unexpected.
  • Maximum load image size: Changed from 13 MB to 32 MB.
    Result: No difference.
  • Turn on SLS (Show Loader Snaps) in Global Flags.
    Result: Lots of extra debug messaged, but no help.
  • Turn on D32 (Kernel 32 debugging) in Global Flags.
    Result: Nothing changes. No extra output in WinDBG, and no change in
    behaviour.
  • Set event in WinDBG to catch the load of the DLL.
    Result: Failing case doesn’t see the DLL loaded. Succeeding case
    sees the DLL loaded.

Does anyone have an idea of how to discover why Windows isn’t even loading
my DLL in one case, and it’s loading just fine in another.

Thanks in advance for any advice.

–
Mats

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named addressee only. It
contains information that may be confidential. Unless you are the named
addressee or an authorized designee, you may not copy or use it, or disclose
it to anyone else. If you received it in error please notify us immediately
and then destroy it.

3

Mats,

Have you tried to put a breakpoint at LoadLibraryEx and such ? I know it’s a
pain, and it may take spending a fair amount of time pressing keys, but if
your debugger has conditional breakpoints you may be able to trap the
attempted dll load, then single step through it, and try to figure out
what’s causing Windows to barf at your executable.

I talked to Chris Plakyda, our SoftICE manager and guru, who used to do
Windows Graphics Driver for a living - I myself used to work with 3D, and I
didn’t do much 2D graphics drivers for NT. He tells me that, from his past
experience, one of the checks that Windows used to do is to match the driver
exports against their “required” list - for example, if the XP driver
requires, say EngAlphaBlt (or whatever it is), and a driver doesn’t support
it, that driver is not an XP driver. So, one thing you can do is to compare
the list of exports before and after your #define, and see if there’s
something missing.

But this is all speculation, and from past experience too. Good luck with
your hunting !

Alberto.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@3Dlabs.com
Sent: Thursday, March 18, 2004 11:46 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Weird non-loading of driver.

As some of you probably already know, I write display drivers.

In the process of doing the next generation chips, we use a simulator, which
is a huge C++ project.

I’ve currently got a driver that runs fine using this simulator. I then
modify the C++ project using a #define, so that it has a slightly different
configurtion. This causes my driver to not load. I don’t mean not run, but
Windows XP refuses to load the driver, and when I open the control panel for
the display, it says “The display driver used for this adapter is for an
older version of Windows” (or something similar to that).

The #define basicly configures the simulated chip slightly different (the
number of internal units in a particular place), and results in a slightly
larger DLL (6.7MB instead of 6.4MB), but should not affect anything in the
display drivers actual funcationality.

I’ve spent most of today trying to figure out what’s going wrong. I had this
once earlier, and in that case it was because I was trying to call an
unsupported memory allocation routine, but I’ve checked for that, and it’s
not that.

So far I’ve checked the following (on Display Driver DLL):

  • Rebuild everything. Makes no difference, I can reliably reproduce it by
    switching the #define back and forth.
  • Imports/Exports/Dependents.
    Result: No different between working and non-working.
  • Other fields of dumpbin output.
    Result: All differences seem to be due to change in size of file,
    nothing unexpected.
  • Maximum load image size: Changed from 13 MB to 32 MB.
    Result: No difference.
  • Turn on SLS (Show Loader Snaps) in Global Flags.
    Result: Lots of extra debug messaged, but no help.
  • Turn on D32 (Kernel 32 debugging) in Global Flags.
    Result: Nothing changes. No extra output in WinDBG, and no change in
    behaviour.
  • Set event in WinDBG to catch the load of the DLL.
    Result: Failing case doesn’t see the DLL loaded. Succeeding case
    sees the DLL loaded.

Does anyone have an idea of how to discover why Windows isn’t even loading
my DLL in one case, and it’s loading just fine in another.

Thanks in advance for any advice.

–
Mats

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named addressee only. It
contains information that may be confidential. Unless you are the named
addressee or an authorized designee, you may not copy or use it, or disclose
it to anyone else. If you received it in error please notify us immediately
and then destroy it.

4

Steve,

Thanks for the quick reply.

I listed that as “Checked Export/Import/Dependents”. I did this both with
the GUI based Depends and the non-gui DUMPBIN.EXE utility, with not
detecting any difference, and one of my collegues checked it too (just in
case). I used DIFF on the output from dumpbin, and the only diffs I got was
due to the size of the file changed. No imports or exports that were
different for the working vs. non-working file.

–
Mats

-----Original Message-----
From: Smith, Steve [mailto:xxxxx@compuware.com]
Sent: Thursday, March 18, 2004 4:52 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

Did you try using depends.exe to find missing import?

Steve
www.compuware.com\products\driverstudio

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@3Dlabs.com
Sent: Thursday, March 18, 2004 11:46 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Weird non-loading of driver.

As some of you probably already know, I write display drivers.

In the process of doing the next generation chips, we use a
simulator, which
is a huge C++ project.

I’ve currently got a driver that runs fine using this
simulator. I then
modify the C++ project using a #define, so that it has a
slightly different
configurtion. This causes my driver to not load. I don’t mean
not run, but
Windows XP refuses to load the driver, and when I open the
control panel for
the display, it says “The display driver used for this
adapter is for an
older version of Windows” (or something similar to that).

The #define basicly configures the simulated chip slightly
different (the
number of internal units in a particular place), and results
in a slightly
larger DLL (6.7MB instead of 6.4MB), but should not affect
anything in the
display drivers actual funcationality.

I’ve spent most of today trying to figure out what’s going
wrong. I had this
once earlier, and in that case it was because I was trying to call an
unsupported memory allocation routine, but I’ve checked for
that, and it’s
not that.

So far I’ve checked the following (on Display Driver DLL):

  • Rebuild everything. Makes no difference, I can reliably
    reproduce it by
    switching the #define back and forth.
  • Imports/Exports/Dependents.
    Result: No different between working and non-working.
  • Other fields of dumpbin output.
    Result: All differences seem to be due to change in
    size of file,
    nothing unexpected.
  • Maximum load image size: Changed from 13 MB to 32 MB.
    Result: No difference.
  • Turn on SLS (Show Loader Snaps) in Global Flags.
    Result: Lots of extra debug messaged, but no help.
  • Turn on D32 (Kernel 32 debugging) in Global Flags.
    Result: Nothing changes. No extra output in WinDBG, and
    no change in
    behaviour.
  • Set event in WinDBG to catch the load of the DLL.
    Result: Failing case doesn’t see the DLL loaded. Succeeding case
    sees the DLL loaded.

Does anyone have an idea of how to discover why Windows isn’t
even loading
my DLL in one case, and it’s loading just fine in another.

Thanks in advance for any advice.

–
Mats

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named
addressee only. It
contains information that may be confidential. Unless you are
the named
addressee or an authorized designee, you may not copy or use
it, or disclose
it to anyone else. If you received it in error please notify
us immediately
and then destroy it.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Mat, I’m not a display driver person. I would recommend debugging the DLL or Driver’s Initialization entry point, to see it is even getting called or not. If not then there is some compatiblity issues, otherwise you might be able to step (thru) the initialization !!!
-prokash

6

Mats,

I’m assuming there’s no non-GDI imports found in dumpbin. To debug such kind
of problem, I use my dummy GDI filter driver. In the filter’s
DrvEnableDriver routine (the only exported routine), it loads the real
display driver (ati2dvag.dll in our case), finds and hooks each DrvXxx
functions in the display driver. I think this may help to find out which
part went wrong.

I’m not sure the size limit of a display driver. I think not putting
everything (D3D, DX, OGL) into a display driver helps reduce the bin size.

BTW, is the miniport being loaded at all?

Good luck,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: xxxxx@3Dlabs.com [mailto:xxxxx@3Dlabs.com]
Sent: Thursday, March 18, 2004 11:46 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Weird non-loading of driver.

As some of you probably already know, I write display drivers.

In the process of doing the next generation chips, we use a
simulator, which
is a huge C++ project.

I’ve currently got a driver that runs fine using this
simulator. I then
modify the C++ project using a #define, so that it has a
slightly different
configurtion. This causes my driver to not load. I don’t mean
not run, but
Windows XP refuses to load the driver, and when I open the
control panel for
the display, it says “The display driver used for this
adapter is for an
older version of Windows” (or something similar to that).

The #define basicly configures the simulated chip slightly
different (the
number of internal units in a particular place), and results
in a slightly
larger DLL (6.7MB instead of 6.4MB), but should not affect
anything in the
display drivers actual funcationality.

I’ve spent most of today trying to figure out what’s going
wrong. I had this
once earlier, and in that case it was because I was trying to call an
unsupported memory allocation routine, but I’ve checked for
that, and it’s
not that.

So far I’ve checked the following (on Display Driver DLL):

  • Rebuild everything. Makes no difference, I can reliably
    reproduce it by
    switching the #define back and forth.
  • Imports/Exports/Dependents.
    Result: No different between working and non-working.
  • Other fields of dumpbin output.
    Result: All differences seem to be due to change in
    size of file,
    nothing unexpected.
  • Maximum load image size: Changed from 13 MB to 32 MB.
    Result: No difference.
  • Turn on SLS (Show Loader Snaps) in Global Flags.
    Result: Lots of extra debug messaged, but no help.
  • Turn on D32 (Kernel 32 debugging) in Global Flags.
    Result: Nothing changes. No extra output in WinDBG, and
    no change in
    behaviour.
  • Set event in WinDBG to catch the load of the DLL.
    Result: Failing case doesn’t see the DLL loaded. Succeeding case
    sees the DLL loaded.

Does anyone have an idea of how to discover why Windows isn’t
even loading
my DLL in one case, and it’s loading just fine in another.

Thanks in advance for any advice.

–
Mats

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@ati.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Alberto,

Thanks for the idea. Unfortunately, I can’t find anything called
LoadLibraryEx or similar, and looking at exported symbols, there’s a
ZwLoadDriver (a.k.a. NtLoadDriver, it seems), is that what I should be
looking for?

–
Mats

-----Original Message-----
From: Moreira, Alberto [mailto:xxxxx@compuware.com]
Sent: Thursday, March 18, 2004 4:56 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

Mats,

Have you tried to put a breakpoint at LoadLibraryEx and such
? I know it’s a
pain, and it may take spending a fair amount of time pressing
keys, but if
your debugger has conditional breakpoints you may be able to trap the
attempted dll load, then single step through it, and try to figure out
what’s causing Windows to barf at your executable.

I talked to Chris Plakyda, our SoftICE manager and guru, who
used to do
Windows Graphics Driver for a living - I myself used to work
with 3D, and I
didn’t do much 2D graphics drivers for NT. He tells me that,
from his past
experience, one of the checks that Windows used to do is to
match the driver
exports against their “required” list - for example, if the XP driver
requires, say EngAlphaBlt (or whatever it is), and a driver
doesn’t support
it, that driver is not an XP driver. So, one thing you can do
is to compare
the list of exports before and after your #define, and see if there’s
something missing.

But this is all speculation, and from past experience too.
Good luck with
your hunting !

Alberto.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@3Dlabs.com
Sent: Thursday, March 18, 2004 11:46 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Weird non-loading of driver.

As some of you probably already know, I write display drivers.

In the process of doing the next generation chips, we use a
simulator, which
is a huge C++ project.

I’ve currently got a driver that runs fine using this
simulator. I then
modify the C++ project using a #define, so that it has a
slightly different
configurtion. This causes my driver to not load. I don’t mean
not run, but
Windows XP refuses to load the driver, and when I open the
control panel for
the display, it says “The display driver used for this
adapter is for an
older version of Windows” (or something similar to that).

The #define basicly configures the simulated chip slightly
different (the
number of internal units in a particular place), and results
in a slightly
larger DLL (6.7MB instead of 6.4MB), but should not affect
anything in the
display drivers actual funcationality.

I’ve spent most of today trying to figure out what’s going
wrong. I had this
once earlier, and in that case it was because I was trying to call an
unsupported memory allocation routine, but I’ve checked for
that, and it’s
not that.

So far I’ve checked the following (on Display Driver DLL):

  • Rebuild everything. Makes no difference, I can reliably
    reproduce it by
    switching the #define back and forth.
  • Imports/Exports/Dependents.
    Result: No different between working and non-working.
  • Other fields of dumpbin output.
    Result: All differences seem to be due to change in
    size of file,
    nothing unexpected.
  • Maximum load image size: Changed from 13 MB to 32 MB.
    Result: No difference.
  • Turn on SLS (Show Loader Snaps) in Global Flags.
    Result: Lots of extra debug messaged, but no help.
  • Turn on D32 (Kernel 32 debugging) in Global Flags.
    Result: Nothing changes. No extra output in WinDBG, and
    no change in
    behaviour.
  • Set event in WinDBG to catch the load of the DLL.
    Result: Failing case doesn’t see the DLL loaded. Succeeding case
    sees the DLL loaded.

Does anyone have an idea of how to discover why Windows isn’t
even loading
my DLL in one case, and it’s loading just fine in another.

Thanks in advance for any advice.

–
Mats

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named
addressee only. It
contains information that may be confidential. Unless you are
the named
addressee or an authorized designee, you may not copy or use
it, or disclose
it to anyone else. If you received it in error please notify
us immediately
and then destroy it.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

If Ur initialization routine ( that is Ur domain :slight_smile: does not get called, then putting BP on either usermode dll loading ms-rutine or the IopLoadDriver routine in the kernel is not that difficult …

-pro

9

Mats,

and looking at exported symbols, there’s a ZwLoadDriver

I don’t understand why you DD would export ZwLoadDriver. Did you mean
import?
Anyway, a display driver shouldn’t import ZwLoadDriver which loads a legacy
.sys file IIRC. It should use EngLoadImage/Module if it needs external
drivers/modules.

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: xxxxx@3Dlabs.com [mailto:xxxxx@3Dlabs.com]
Sent: Thursday, March 18, 2004 12:35 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

Alberto,

Thanks for the idea. Unfortunately, I can’t find anything called
LoadLibraryEx or similar, and looking at exported symbols, there’s a
ZwLoadDriver (a.k.a. NtLoadDriver, it seems), is that what I should be
looking for?

–
Mats

> -----Original Message-----
> From: Moreira, Alberto [mailto:xxxxx@compuware.com]
> Sent: Thursday, March 18, 2004 4:56 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Weird non-loading of driver.
>
>
> Mats,
>
> Have you tried to put a breakpoint at LoadLibraryEx and such
> ? I know it’s a
> pain, and it may take spending a fair amount of time pressing
> keys, but if
> your debugger has conditional breakpoints you may be able
to trap the
> attempted dll load, then single step through it, and try to
figure out
> what’s causing Windows to barf at your executable.
>
> I talked to Chris Plakyda, our SoftICE manager and guru, who
> used to do
> Windows Graphics Driver for a living - I myself used to work
> with 3D, and I
> didn’t do much 2D graphics drivers for NT. He tells me that,
> from his past
> experience, one of the checks that Windows used to do is to
> match the driver
> exports against their “required” list - for example, if the
XP driver
> requires, say EngAlphaBlt (or whatever it is), and a driver
> doesn’t support
> it, that driver is not an XP driver. So, one thing you can do
> is to compare
> the list of exports before and after your #define, and see
if there’s
> something missing.
>
> But this is all speculation, and from past experience too.
> Good luck with
> your hunting !
>
> Alberto.
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of
> xxxxx@3Dlabs.com
> Sent: Thursday, March 18, 2004 11:46 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Weird non-loading of driver.
>
>
> As some of you probably already know, I write display drivers.
>
> In the process of doing the next generation chips, we use a
> simulator, which
> is a huge C++ project.
>
> I’ve currently got a driver that runs fine using this
> simulator. I then
> modify the C++ project using a #define, so that it has a
> slightly different
> configurtion. This causes my driver to not load. I don’t mean
> not run, but
> Windows XP refuses to load the driver, and when I open the
> control panel for
> the display, it says “The display driver used for this
> adapter is for an
> older version of Windows” (or something similar to that).
>
> The #define basicly configures the simulated chip slightly
> different (the
> number of internal units in a particular place), and results
> in a slightly
> larger DLL (6.7MB instead of 6.4MB), but should not affect
> anything in the
> display drivers actual funcationality.
>
> I’ve spent most of today trying to figure out what’s going
> wrong. I had this
> once earlier, and in that case it was because I was trying
to call an
> unsupported memory allocation routine, but I’ve checked for
> that, and it’s
> not that.
>
> So far I’ve checked the following (on Display Driver DLL):
> - Rebuild everything. Makes no difference, I can reliably
> reproduce it by
> switching the #define back and forth.
> - Imports/Exports/Dependents.
> Result: No different between working and non-working.
> - Other fields of dumpbin output.
> Result: All differences seem to be due to change in
> size of file,
> nothing unexpected.
> - Maximum load image size: Changed from 13 MB to 32 MB.
> Result: No difference.
> - Turn on SLS (Show Loader Snaps) in Global Flags.
> Result: Lots of extra debug messaged, but no help.
> - Turn on D32 (Kernel 32 debugging) in Global Flags.
> Result: Nothing changes. No extra output in WinDBG, and
> no change in
> behaviour.
> - Set event in WinDBG to catch the load of the DLL.
> Result: Failing case doesn’t see the DLL loaded. Succeeding case
> sees the DLL loaded.
>
>
> Does anyone have an idea of how to discover why Windows isn’t
> even loading
> my DLL in one case, and it’s loading just fine in another.
>
> Thanks in advance for any advice.
>
> –
> Mats
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@compuware.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com
>
>
>
> The contents of this e-mail are intended for the named
> addressee only. It
> contains information that may be confidential. Unless you are
> the named
> addressee or an authorized designee, you may not copy or use
> it, or disclose
> it to anyone else. If you received it in error please notify
> us immediately
> and then destroy it.
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@3dlabs.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com
>

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@ati.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

10

According to WinDBG, when it fails, the driver doesn’t get loaded. If I
change the #define, the DLL gets loaded, and WinDBG will stop at the load
point. Change the #define again, DLL doesn’t get loaded (at all). So there’s
no DLL entry point to step through. [it would have been easy to do that…
;-)]

–
Mats

-----Original Message-----
From: xxxxx@garlic.com [mailto:xxxxx@garlic.com]
Sent: Thursday, March 18, 2004 5:25 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Weird non-loading of driver.

Mat, I’m not a display driver person. I would recommend
debugging the DLL or Driver’s Initialization entry point, to
see it is even getting called or not. If not then there is
some compatiblity issues, otherwise you might be able to step
(thru) the initialization !!!
-prokash

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

11

Calvin,

Thanks for the reply.

I’m sure there’s no non-GDI imports in the driver, as the imports list for
the workign version and the non-working one has the same imports and exports
list.

When you say filter driver, you basicly mean that you have a tiny DLL with
the very basic entry-points, and then load the “real” one manually, yes?

As I see it, there shouldn’t be any special limits for display drivers, but
there is a registry key that I’ve changed from 13MB to 32MB, which is
supposed to enable the load-image size to be “large”. I think the default
value of this is something like 4MB, and it’s not sufficient for our
simulated drivers. I’m not aware that there is a greater limit aside from
what the registry says.

Yes, the miniport is loaded both in the working and non-working case, and
it’s unchanged between working and non-working case.

I’m currently following up on Alberto’s tip on setting a breakpoint in the
driver load routine (if I can figure out what the right place is), which may
give some more leads…

–
Mats

-----Original Message-----
From: Calvin Guan [mailto:xxxxx@ati.com]
Sent: Thursday, March 18, 2004 5:29 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

Mats,

I’m assuming there’s no non-GDI imports found in dumpbin. To debug such kind
of problem, I use my dummy GDI filter driver. In the filter’s
DrvEnableDriver routine (the only exported routine), it loads the real
display driver (ati2dvag.dll in our case), finds and hooks each DrvXxx
functions in the display driver. I think this may help to find out which
part went wrong.

I’m not sure the size limit of a display driver. I think not putting
everything (D3D, DX, OGL) into a display driver helps reduce the bin size.

BTW, is the miniport being loaded at all?

Good luck,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: xxxxx@3Dlabs.com [ mailto:xxxxx@3Dlabs.com
mailto:xxxxx ]
> Sent: Thursday, March 18, 2004 11:46 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Weird non-loading of driver.
>
>
> As some of you probably already know, I write display drivers.
>
> In the process of doing the next generation chips, we use a
> simulator, which
> is a huge C++ project.
>
> I’ve currently got a driver that runs fine using this
> simulator. I then
> modify the C++ project using a #define, so that it has a
> slightly different
> configurtion. This causes my driver to not load. I don’t mean
> not run, but
> Windows XP refuses to load the driver, and when I open the
> control panel for
> the display, it says “The display driver used for this
> adapter is for an
> older version of Windows” (or something similar to that).
>
> The #define basicly configures the simulated chip slightly
> different (the
> number of internal units in a particular place), and results
> in a slightly
> larger DLL (6.7MB instead of 6.4MB), but should not affect
> anything in the
> display drivers actual funcationality.
>
> I’ve spent most of today trying to figure out what’s going
> wrong. I had this
> once earlier, and in that case it was because I was trying to call an
> unsupported memory allocation routine, but I’ve checked for
> that, and it’s
> not that.
>
> So far I’ve checked the following (on Display Driver DLL):
> - Rebuild everything. Makes no difference, I can reliably
> reproduce it by
> switching the #define back and forth.
> - Imports/Exports/Dependents.
> Result: No different between working and non-working.
> - Other fields of dumpbin output.
> Result: All differences seem to be due to change in
> size of file,
> nothing unexpected.
> - Maximum load image size: Changed from 13 MB to 32 MB.
> Result: No difference.
> - Turn on SLS (Show Loader Snaps) in Global Flags.
> Result: Lots of extra debug messaged, but no help.
> - Turn on D32 (Kernel 32 debugging) in Global Flags.
> Result: Nothing changes. No extra output in WinDBG, and
> no change in
> behaviour.
> - Set event in WinDBG to catch the load of the DLL.
> Result: Failing case doesn’t see the DLL loaded. Succeeding case
> sees the DLL loaded.
>
>
> Does anyone have an idea of how to discover why Windows isn’t
> even loading
> my DLL in one case, and it’s loading just fine in another.
>
> Thanks in advance for any advice.
>
> –
> Mats
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
http:

You are currently subscribed to ntdev as: xxxxx@ati.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com</http:></mailto:xxxxx>

12

Thanks, I see IopLoadDriver in the stack when breakpointing on the load of
the DLL in WinDBG. I’ll give that a try on the failing case.

Again, thanks for the tip.

–
Mats

-----Original Message-----
From: xxxxx@garlic.com [mailto:xxxxx@garlic.com]
Sent: Thursday, March 18, 2004 5:35 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

If Ur initialization routine ( that is Ur domain :slight_smile: does not
get called, then putting BP on either usermode dll loading
ms-rutine or the IopLoadDriver routine in the kernel is not
that difficult …

-pro

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

13

Sorry, but that was meant to say “Looking at exported NT!* symbols”. Anyway,
ZwLoadDriver, I’ve noticed, is not used to load my driver, which is what I’m
trying to find…

I’ve found something that seems like a good candiate: win32k!ldevLoadImage.
Stepping through it right now…

–
Mats

-----Original Message-----
From: Calvin Guan [mailto:xxxxx@ati.com]
Sent: Thursday, March 18, 2004 5:55 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

Mats,

and looking at exported symbols, there’s a ZwLoadDriver

I don’t understand why you DD would export ZwLoadDriver. Did you mean
import?
Anyway, a display driver shouldn’t import ZwLoadDriver which loads a legacy
.sys file IIRC. It should use EngLoadImage/Module if it needs external
drivers/modules.

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: xxxxx@3Dlabs.com [ mailto:xxxxx@3Dlabs.com
mailto:xxxxx ]
> Sent: Thursday, March 18, 2004 12:35 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Weird non-loading of driver.
>
>
> Alberto,
>
> Thanks for the idea. Unfortunately, I can’t find anything called
> LoadLibraryEx or similar, and looking at exported symbols, there’s a
> ZwLoadDriver (a.k.a. NtLoadDriver, it seems), is that what I should be
> looking for?
>
> –
> Mats
>
> > -----Original Message-----
> > From: Moreira, Alberto [mailto:xxxxx@compuware.com
mailto:xxxxx]
> > Sent: Thursday, March 18, 2004 4:56 PM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] Weird non-loading of driver.
> >
> >
> > Mats,
> >
> > Have you tried to put a breakpoint at LoadLibraryEx and such
> > ? I know it’s a
> > pain, and it may take spending a fair amount of time pressing
> > keys, but if
> > your debugger has conditional breakpoints you may be able
> to trap the
> > attempted dll load, then single step through it, and try to
> figure out
> > what’s causing Windows to barf at your executable.
> >
> > I talked to Chris Plakyda, our SoftICE manager and guru, who
> > used to do
> > Windows Graphics Driver for a living - I myself used to work
> > with 3D, and I
> > didn’t do much 2D graphics drivers for NT. He tells me that,
> > from his past
> > experience, one of the checks that Windows used to do is to
> > match the driver
> > exports against their “required” list - for example, if the
> XP driver
> > requires, say EngAlphaBlt (or whatever it is), and a driver
> > doesn’t support
> > it, that driver is not an XP driver. So, one thing you can do
> > is to compare
> > the list of exports before and after your #define, and see
> if there’s
> > something missing.
> >
> > But this is all speculation, and from past experience too.
> > Good luck with
> > your hunting !
> >
> > Alberto.
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com
mailto:xxxxx]On Behalf Of
> > xxxxx@3Dlabs.com
> > Sent: Thursday, March 18, 2004 11:46 AM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] Weird non-loading of driver.
> >
> >
> > As some of you probably already know, I write display drivers.
> >
> > In the process of doing the next generation chips, we use a
> > simulator, which
> > is a huge C++ project.
> >
> > I’ve currently got a driver that runs fine using this
> > simulator. I then
> > modify the C++ project using a #define, so that it has a
> > slightly different
> > configurtion. This causes my driver to not load. I don’t mean
> > not run, but
> > Windows XP refuses to load the driver, and when I open the
> > control panel for
> > the display, it says “The display driver used for this
> > adapter is for an
> > older version of Windows” (or something similar to that).
> >
> > The #define basicly configures the simulated chip slightly
> > different (the
> > number of internal units in a particular place), and results
> > in a slightly
> > larger DLL (6.7MB instead of 6.4MB), but should not affect
> > anything in the
> > display drivers actual funcationality.
> >
> > I’ve spent most of today trying to figure out what’s going
> > wrong. I had this
> > once earlier, and in that case it was because I was trying
> to call an
> > unsupported memory allocation routine, but I’ve checked for
> > that, and it’s
> > not that.
> >
> > So far I’ve checked the following (on Display Driver DLL):
> > - Rebuild everything. Makes no difference, I can reliably
> > reproduce it by
> > switching the #define back and forth.
> > - Imports/Exports/Dependents.
> > Result: No different between working and non-working.
> > - Other fields of dumpbin output.
> > Result: All differences seem to be due to change in
> > size of file,
> > nothing unexpected.
> > - Maximum load image size: Changed from 13 MB to 32 MB.
> > Result: No difference.
> > - Turn on SLS (Show Loader Snaps) in Global Flags.
> > Result: Lots of extra debug messaged, but no help.
> > - Turn on D32 (Kernel 32 debugging) in Global Flags.
> > Result: Nothing changes. No extra output in WinDBG, and
> > no change in
> > behaviour.
> > - Set event in WinDBG to catch the load of the DLL.
> > Result: Failing case doesn’t see the DLL loaded. Succeeding case
> > sees the DLL loaded.
> >
> >
> > Does anyone have an idea of how to discover why Windows isn’t
> > even loading
> > my DLL in one case, and it’s loading just fine in another.
> >
> > Thanks in advance for any advice.
> >
> > –
> > Mats
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
http:
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@compuware.com
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> >
> >
> >
> > The contents of this e-mail are intended for the named
> > addressee only. It
> > contains information that may be confidential. Unless you are
> > the named
> > addressee or an authorized designee, you may not copy or use
> > it, or disclose
> > it to anyone else. If you received it in error please notify
> > us immediately
> > and then destroy it.
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
http:
> >
> > You are currently subscribed to ntdev as: xxxxx@3dlabs.com
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
http:
>
> You are currently subscribed to ntdev as: xxxxx@ati.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com</http:></http:></http:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>

14

For LoadLibrary*(), it is user mode, so look at the sdk doc, finde the lib needs to be included, probably kernel32.lib, then thru depends you will see the names from the respective dll…

For debugging, I would grab the symbols, and if you use softice, it’s a boon, one session, usr/krnl, step the way you like, even to someone’s head :).
-pro

15

Does it change the name of the initialization routine, in anyway ? Managling, etc !. Either it is a usr-mode init, or k-mode init, And by default the DllMain or DriverEntry are the label for loading/initing, unless of course you change something at the link stage to make a different entry point…

BTW, dont worry for size etc, these are file-mapped, hardly any fix sizes…

-pro

16

in XP the driver load path looks something like this (currently):

[Nt|Zw]LoadDriver posts work over to a system thread and calls
IopLoadUnloadDriver().

IopLoadUnloadDriver() calls IopLoadDriver(service key, x, x, out
ntstatus DriverEntryStatus) to do the actual driver load.

IopLoadDriver does the following things:

* it uses the service key to find out the service name and the image
to load.
* It walks the loaded module list to see if it’s already been
initialized (this is an error - STATUS_IMAGE_ALREADY_LOADED is
returned).
* It calls MmLoadSystemImage to actually load the module into memory.
This does the import resolution, etc…
* It creates the driver object and inserts it into the \Drivers
directory
* It finds the driver’s entry point (DriverEntry usually) and calls
it, then returns the status of DriverEntry in DriverEntryStatus.

I’d guess you’re failing at MmLoadSystemImage - the status that returns
might give you an idea what the problem is.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@3Dlabs.com
Sent: Thursday, March 18, 2004 10:10 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

Thanks, I see IopLoadDriver in the stack when breakpointing on the load
of the DLL in WinDBG. I’ll give that a try on the failing case.

Again, thanks for the tip.

–
Mats

-----Original Message-----
From: xxxxx@garlic.com [mailto:xxxxx@garlic.com]
Sent: Thursday, March 18, 2004 5:35 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

If Ur initialization routine ( that is Ur domain :slight_smile: does not get
called, then putting BP on either usermode dll loading ms-rutine or
the IopLoadDriver routine in the kernel is not that difficult …

-pro

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com To

unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

17

When you change the #define and the DLL gets loaded, you get control at the
DLL init, and Windbg breaks at the load point. If now you look at the stack,
you might see the OS function that loaded the DLL. Now, you can change the
#define back, and break at that entry point instead, and you will have
control immediately before the system tries to load your driver dll. The
problem is, there’s going to be a pile and a half of other dll’s that are
going to be loaded through that path, so, you may have to have some patience
to hit the right load attempt, and then even more to figure out what’s
causing your module not to load. That’s why I mentioned, if Windbg has any
kind of programmable breakpoint, that may save some work. I did this kind of
thing way back when a couple of times, but it’s been a long, long time !

Alberto.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@3Dlabs.com
Sent: Thursday, March 18, 2004 1:01 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Weird non-loading of driver.

According to WinDBG, when it fails, the driver doesn’t get loaded. If I
change the #define, the DLL gets loaded, and WinDBG will stop at the load
point. Change the #define again, DLL doesn’t get loaded (at all). So there’s
no DLL entry point to step through. [it would have been easy to do that…
;-)]

–
Mats

-----Original Message-----
From: xxxxx@garlic.com [mailto:xxxxx@garlic.com]
Sent: Thursday, March 18, 2004 5:25 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Weird non-loading of driver.

Mat, I’m not a display driver person. I would recommend
debugging the DLL or Driver’s Initialization entry point, to
see it is even getting called or not. If not then there is
some compatiblity issues, otherwise you might be able to step
(thru) the initialization !!!
-prokash

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named addressee only. It
contains information that may be confidential. Unless you are the named
addressee or an authorized designee, you may not copy or use it, or disclose
it to anyone else. If you received it in error please notify us immediately
and then destroy it.

18

Put the breakpoint to DrvEnableDriver.
Look at the call stack then.
Then trace the assembly code after return from your DrvEnableDriver.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Thursday, March 18, 2004 8:35 PM
Subject: RE: [ntdev] Weird non-loading of driver.

> Alberto,
>
> Thanks for the idea. Unfortunately, I can’t find anything called
> LoadLibraryEx or similar, and looking at exported symbols, there’s a
> ZwLoadDriver (a.k.a. NtLoadDriver, it seems), is that what I should be
> looking for?
>
> –
> Mats
>
> > -----Original Message-----
> > From: Moreira, Alberto [mailto:xxxxx@compuware.com]
> > Sent: Thursday, March 18, 2004 4:56 PM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] Weird non-loading of driver.
> >
> >
> > Mats,
> >
> > Have you tried to put a breakpoint at LoadLibraryEx and such
> > ? I know it’s a
> > pain, and it may take spending a fair amount of time pressing
> > keys, but if
> > your debugger has conditional breakpoints you may be able to trap the
> > attempted dll load, then single step through it, and try to figure out
> > what’s causing Windows to barf at your executable.
> >
> > I talked to Chris Plakyda, our SoftICE manager and guru, who
> > used to do
> > Windows Graphics Driver for a living - I myself used to work
> > with 3D, and I
> > didn’t do much 2D graphics drivers for NT. He tells me that,
> > from his past
> > experience, one of the checks that Windows used to do is to
> > match the driver
> > exports against their “required” list - for example, if the XP driver
> > requires, say EngAlphaBlt (or whatever it is), and a driver
> > doesn’t support
> > it, that driver is not an XP driver. So, one thing you can do
> > is to compare
> > the list of exports before and after your #define, and see if there’s
> > something missing.
> >
> > But this is all speculation, and from past experience too.
> > Good luck with
> > your hunting !
> >
> > Alberto.
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of
> > xxxxx@3Dlabs.com
> > Sent: Thursday, March 18, 2004 11:46 AM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] Weird non-loading of driver.
> >
> >
> > As some of you probably already know, I write display drivers.
> >
> > In the process of doing the next generation chips, we use a
> > simulator, which
> > is a huge C++ project.
> >
> > I’ve currently got a driver that runs fine using this
> > simulator. I then
> > modify the C++ project using a #define, so that it has a
> > slightly different
> > configurtion. This causes my driver to not load. I don’t mean
> > not run, but
> > Windows XP refuses to load the driver, and when I open the
> > control panel for
> > the display, it says “The display driver used for this
> > adapter is for an
> > older version of Windows” (or something similar to that).
> >
> > The #define basicly configures the simulated chip slightly
> > different (the
> > number of internal units in a particular place), and results
> > in a slightly
> > larger DLL (6.7MB instead of 6.4MB), but should not affect
> > anything in the
> > display drivers actual funcationality.
> >
> > I’ve spent most of today trying to figure out what’s going
> > wrong. I had this
> > once earlier, and in that case it was because I was trying to call an
> > unsupported memory allocation routine, but I’ve checked for
> > that, and it’s
> > not that.
> >
> > So far I’ve checked the following (on Display Driver DLL):
> > - Rebuild everything. Makes no difference, I can reliably
> > reproduce it by
> > switching the #define back and forth.
> > - Imports/Exports/Dependents.
> > Result: No different between working and non-working.
> > - Other fields of dumpbin output.
> > Result: All differences seem to be due to change in
> > size of file,
> > nothing unexpected.
> > - Maximum load image size: Changed from 13 MB to 32 MB.
> > Result: No difference.
> > - Turn on SLS (Show Loader Snaps) in Global Flags.
> > Result: Lots of extra debug messaged, but no help.
> > - Turn on D32 (Kernel 32 debugging) in Global Flags.
> > Result: Nothing changes. No extra output in WinDBG, and
> > no change in
> > behaviour.
> > - Set event in WinDBG to catch the load of the DLL.
> > Result: Failing case doesn’t see the DLL loaded. Succeeding case
> > sees the DLL loaded.
> >
> >
> > Does anyone have an idea of how to discover why Windows isn’t
> > even loading
> > my DLL in one case, and it’s loading just fine in another.
> >
> > Thanks in advance for any advice.
> >
> > –
> > Mats
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@compuware.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> > The contents of this e-mail are intended for the named
> > addressee only. It
> > contains information that may be confidential. Unless you are
> > the named
> > addressee or an authorized designee, you may not copy or use
> > it, or disclose
> > it to anyone else. If you received it in error please notify
> > us immediately
> > and then destroy it.
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: xxxxx@3dlabs.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

19

>usermode dll loading ms-rutine or the IopLoadDriver routine in the kernel is
not that difficult …

I’m not sure MmLoadSystemImage or IopLoadDriver are used for display DLLs.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com