CODEWITHSUNDEEP
windowswindows-7kernel
agent.smith
agent.smith

Reputation: 9436

New driver installation on Windows

I am trying to find what happens when new driver is installed for windows. (What kernel data structures are modified.) Does anyone know any good documentation on this topic. It is a bit painful to debug this.

Thanks

Upvotes: 0

Views: 89

Answers (1)

djp
djp

Reputation: 646

When a driver is installed is it placed into the Driver Store (see http://msdn.microsoft.com/en-us/library/ff544868%28v=vs.85%29.aspx)

When a new device is discovered that does not have a current driver association the PNP manager looks at the driver store to see if any of the stored drivers will match the new device.

If the PNP manager finds a driver to match the device it will execute the directives in the drivers inf file. This typically creates a service entry in the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services), copies the driver binaries to somewhere like \Windows\System32\drivers etc. Also the PNP manager will create an association of that device to that driver (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum I think) so that next time it can shortcut the process.

I don't think any kernel data structures are modified when a driver is installed. Do you mean to ask when a driver is loaded?

Upvotes: 1

Related Questions