Windows Driver Developement Local debugging questions.

Question

Here is the scenario. I am on windows 8 Machine/ Also have tried this on windows 7 machine.

I working on a driver(mirror driver/Remote display Driver). I should say I am going to start working on it as I am stuck.

So I followed the MSDN example of KmdfSmall

http://msdn.microsoft.com/en-us/library/windows/hardware/hh439665(v=vs.85).aspx

I got the driver code compiled. Got the remote debugging also going.

I do not see any of the debug messages on the host( I have set the register IHVDRIVER to 0x8 I also set the DEFAULT to 0xf to be able to use DbgPrint

Further more. My real goal is start my driver as a service

http://www.codeproject.com/Articles/9504/Driver-Development-Part-1-Introduction-to-Drivers

And I want to test it on the LOCAL machine. I do not want to have a target and host to debug. Plain oldschool single machine.

Questions

1) When service starts the driver via CreateService and OpenService, does it call the DriverEntry function or does it wait until someone user level app uses the driver.

2) When I run the app to load the driver as a server where would the DbgPrintEx suppose to print DebugView or WinDbg or else where.

3) If I am using

CreateService

does my sys file has to be in windows/system32/drivers folder ? I read somewhere that in 64 bit machine CreateService only loads from system folder.

4) when I start it as a service am I suppose to see it on the task Manager

5)If DriverEntry is called to init a driver, can it be called again or it has to wait until it unloads ? So I load my driver and forget to gracefully unload it and run my program again will it call DriverEntry ?

I know there are a lot of questions here. Thanks in advance

Answer 1

KMDF driver cannot be installed using old style API. Check this sample from MSDN.

You also need to think about what kind of driver it is, filter driver or actual device driver etc.

1) When service starts the driver via CreateService and OpenService, does it call the DriverEntry function or does it wait until someone user level app uses the driver.

As soon as the driver is loaded, its DriverEntry routine is called.

2) When I run the app to load the driver as a server where would the DbgPrintEx suppose to print DebugView or WinDbg or else where.

When none of DebugView or WinDbg is running, the output is lost and not printed/logged anywhere.

3) If I am using CreateService does my sys file has to be in windows/system32/drivers folder ? I read somewhere that in 64 bit machine CreateService only loads from system folder.

Newer windows has such kind of restriction.

4) when I start it as a service am I suppose to see it on the task Manager

Kernel drivers are not listed in task manager as they are actually part of OS not a separate application. However, if you have user level service, it will be listed in task manager when its running.

5)If DriverEntry is called to init a driver, can it be called again or it has to wait until it unloads ? So I load my driver and forget to gracefully unload it and run my program again will it call DriverEntry ?

DriverEntry is called each time the driver is loaded. If the driver is demand load, it will run each time the driver is loaded/started, even if driver does not unload gracefully (e.g. leaking memory/locks etc). But you may end up in unstable system and BSOD if driver doesn't unload neatly.