Windows Driver - How do I determine if Windows is in the process of booting, or has already booted? -


i'm trying develop dual purpose driver performs tasks @ boot time, , other unrelated tasks after windows has started. it's developed boot start driver. understand proper way may develop 2 separate drivers, i'd prefer go through winqual process once. there's added benefit of performing 1 driver install in app versus two. needs work on vista through win8 x86 & 64.

so i'm looking safe way determine in driverinit if system in process of booting, or if it's , running. driver utilized when windows has started, enabled @ boot time after next reboot. driverinit code needs different both scenarios.

is there registry key or not present?

can determine if user logged-in in driverinit?

is there call can make determine if windows booting?

i'm not expert @ driver writing, in advance advice.

at time boot-start drivers loaded windows has not created user-mode processes yet. try acquire handle process supposed created later on during windows startup. example, smss.exe, csrss.exe or wininit.exe . (processes these names existed many years, unlikely microdoft abandons them in future while still allowing existing kernel mode modules run.) use zwopenprocess pobject_attributes pointing 1 of process' names. if call fails @ boot time.

also may study windows startup described in "windows internals" russinovich , solomon. number of other ideas.


Comments

Popular posts from this blog

php - Calling a template part from a post -

Firefox SVG shape not printing when it has stroke -

How to mention the localhost in android -