Question

Some drivers on Windows, like Null and Beep, can be arbitrarily stopped and re-started through the ControlService(..., SERVICE_CONTROL_STOP, ...) operation. Most other drivers, however, cannot be stopped and restarted while the system is running.

I’m making my own driver. How can I tell Windows that my driver can be stopped?

Answer 1

It turns out that you need to add a DriverUnload function:

VOID NTAPI DriverUnload(IN DRIVER_OBJECT *DriverObject) { }

NTSTATUS NTAPI DriverEntry(IN PDRIVER_OBJECT DriverObject,
                           IN PUNICODE_STRING RegistryPath)
{
    DriverObject->DriverUnload = DriverUnload; // <--- add this
    return STATUS_SUCCESS;
}

However, this is only sufficient if you’re linking with /DRIVER.
If you’re linking with /DRIVER:WDM (meaning that IMAGE_DLLCHARACTERISTICS_WDM_DRIVER is set in the DllCharacteristics field) then it seems like this isn’t sufficient. I think you may need to do more things, like handling IRPs as well. So check that too.