Home/ Questions/Q 3805068
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-19T14:37:07+00:00

I always set my drivers Imagepath directly.(C:\Windows\System32\drivers\abc.sys) But I just knew many device drivers

  • 0

I always set my drivers Imagepath directly.(C:\Windows\System32\drivers\abc.sys)

But I just knew many device drivers set their ImagePath to %SystemRoot%\system32\svchost.exe -k netsvcs
enter image description here
This is Lanmanworkstation driver’s registry hive.
I guess Lanmanworkstation driver’s image file is mrxsmb.sys
But they didn’t put ‘System32\drivers\mrxsmb.sys’. Why.

What does svchost.exe -k netsvcs mean?
Even though there is no certain path, StartService function works well.
How does Service Manager(? i’m not sure) find the driver’s image path?

Is there an advantage using this?
What if I decide to use this way, are there my driver codes should modify?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You are confusing between device drivers and services.
    svchost.exe is used to share the same process between multiple services. The implementation is internal to Windows so use outside of Windows is not supported.

    If you write a device driver (for hardware, or a filter driver) or do not work for Microsoft, you cannot use svchost.

    The reason for the confusion is because old style (NT4), non-plug-and-play drivers can be started using the Service Control Manager APIs.

    • 0