OSR's ntdev List: Loaded Module list

Message 1 of 4

20 Jul 06 08:16

JB Lernout

xxxxxx@gmail.com

Join Date: 22 Dec 2005

Posts To This List: 5

Loaded Module list

Hi all, I made a small driver which registers a notification callback using the PsSetLoadImageNotifyRoutine function. It works fine and I'm correctly notified. But there is something strange. I'm notified for these images : - \SystemRoot\system32\DRIVERS\USBD.SYS - \SystemRoot\System32\DRIVERS\TDI.SYS - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS - \SystemRoot\system32\DRIVERS\USBPORT.SYS - \SystemRoot\System32\DRIVERS\ks.sys - \SystemRoot\System32\drivers\dxgthk.sys - \SystemRoot\System32\drivers\dxg.sys - \SystemRoot\System32\watchdog.sys - \SystemRoot\System32\drivers\Dxapi.sys But they are not listed by ObjDir nor DeviceTree. Is this normal ? JB

Message 2 of 4

20 Jul 06 09:26

Slava Imameyev

xxxxxx@fromru.com

Join Date: 30 Apr 2003

Posts To This List: 90

Re: Loaded Module list

It is normal because driver objects are not created for this modules. <xxxxx@gmail.com> wrote in message news:80189@ntdev... > Hi all, > > I made a small driver which registers a notification callback using the > PsSetLoadImageNotifyRoutine function. It works fine and I'm correctly > notified. But there is something strange. > > I'm notified for these images : > - \SystemRoot\system32\DRIVERS\USBD.SYS > - \SystemRoot\System32\DRIVERS\TDI.SYS > - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS <...excess quoted lines suppressed...>

Message 3 of 4

20 Jul 06 10:05

Doron Holan

xxxxxx@microsoft.com

Join Date: 08 Sep 2005

Posts To This List: 5313

RE: Loaded Module list

...because most, if not all of these drivers, are export drivers which are loaded during import resolution of other drivers. d -- I can spell, I just can't type. -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Slava Imameyev Sent: Thursday, July 20, 2006 6:26 AM To: Windows System Software Devs Interest List Subject: Re:[ntdev] Loaded Module list It is normal because driver objects are not created for this modules. <xxxxx@gmail.com> wrote in message news:80189@ntdev... > Hi all, > > I made a small driver which registers a notification callback using > the PsSetLoadImageNotifyRoutine function. It works fine and I'm > correctly notified. But there is something strange. > > I'm notified for these images : > - \SystemRoot\system32\DRIVERS\USBD.SYS > - \SystemRoot\System32\DRIVERS\TDI.SYS > - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS <...excess quoted lines suppressed...> --- Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Message 4 of 4

20 Jul 06 10:14

JB Lernout

xxxxxx@gmail.com

Join Date: 22 Dec 2005

Posts To This List: 5

RE: Loaded Module list

Thanks for your answer JB

Posting Rules
You may not post new threads You may not post replies You may not post attachments	You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 13:45.

Contact Us - Osr Online Homepage - Top