Windows Driver - How do I determine if Windows is in the process of booting, or has already booted? -
i'm trying develop dual purpose driver performs tasks @ boot time, , other unrelated tasks after windows has started. it's developed boot start driver. understand proper way may develop 2 separate drivers, i'd prefer go through winqual process once. there's added benefit of performing 1 driver install in app versus two. needs work on vista through win8 x86 & 64.
so i'm looking safe way determine in driverinit if system in process of booting, or if it's , running. driver utilized when windows has started, enabled @ boot time after next reboot. driverinit code needs different both scenarios.
is there registry key or not present?
can determine if user logged-in in driverinit?
is there call can make determine if windows booting?
i'm not expert @ driver writing, in advance advice.
at time boot-start drivers loaded windows has not created user-mode processes yet. try acquire handle process supposed created later on during windows startup. example, smss.exe, csrss.exe or wininit.exe . (processes these names existed many years, unlikely microdoft abandons them in future while still allowing existing kernel mode modules run.) use zwopenprocess
pobject_attributes
pointing 1 of process' names. if call fails @ boot time.
also may study windows startup described in "windows internals" russinovich , solomon. number of other ideas.
Comments
Post a Comment