CODEWITHSUNDEEP
windowskerneldriver
Jämes
Jämes

Reputation: 7245

Can I protect a Windows driver from being unloaded?

I'm developing a software driver for software protection and I would like to be able to prevent my driver from being unloaded without internal checks.

Is there a way to prevent a driver from being unloaded from the kernel (any callback that catches this event to deny the unload operation) ?

Upvotes: 0

Views: 355

Answers (1)

Baget
Baget

Reputation: 3346

You can't do it since Windows is Controlling it, what you can do it declare the device as NotDisableable in the WDF_DEVICE_STATE, it is done via WdfDeviceSetDeviceState() function

Example:

WDF_DEVICE_STATE deviceState;
WDF_DEVICE_STATE_INIT(&deviceState);

deviceState.NotDisableable = WdfFalse;
status = WdfDeviceSetDeviceState(Device, &deviceState);

Upvotes: 1

Related Questions