Restart a device driver

[zaphy2k2]

Hi,

I have a situation where i need to restart (or start) a system driver. I have an elo touchscreen which reads calibration data from the registry on boot, but does not poll the registry after that. I need to stop this driver/device and then restart it again so it will read the new registry values.

Rebooting the system is not an option (its a remote boot win xpe image), and i would rather not have 200 different images of those, with only one registry key difference.

Any help wuold be greatly appreciated,

cheers,
aaron

 

[B00gyeMan]

Most of the drivers are loaded as services (FS or kernel mode drivers). You can obtain a full list of drivers using the services related API provided by Microsoft:
- OpenSCManager - to open the Service control manager
- EnumServicesStatus - to enumerate services with a certain status(es), combination accepted;

After enumerating services and finding the one you need (and let's hope it is loaded as a service) you can execute OpenService for the service in your interest and QueryServiceStatus to get detailed information about its state and accepted controls (like netbind, start, stop, pause, parameter change and others). If it accepts start and stop you can re-start it :-D

Please look above APIs (and related) in MSDN for more information.

Hope this will help you

 

[zaphy2k2]

Hi,

I think this could be what i need i will check the code now, i have a feeling though it is not listed as a service. Would it be in the computer management section even if it wasnt? MouseMon.sys gets loaded at startup.


cheers,
aaron

 

[zaphy2k2]

Hi again,

The driver is not listed as a service, do i have any other options?

The control panal interface supplied with the driver does what i need my function to do, is there any way i can find out what function this is calling? Or open the .sys to call a function on it?


cheers,
aaron

 

[B00gyeMan]

I am not very familiar with device drivers, so unfortunately I cannot help you regarding this matter.
Of course, you can always try to disassemble the module and carefully look at the imported/exported methods, and relationships between the actual driver and the other modules, and further try to use the exported methods.

Another method could probably be the use of the IOCtl functions.

 

[AirCon]

zaphy2k2,

B00gyeMan is correct. That's the API you need to stop the service.

If you use NT based, the service will be listed. Some of the driver which is belong to the core system , will not be listed or hidden (ie.: VGA.SYS)

If you use Win9X, there are no service list.

But they are all services. Notes, some of kernel services cannot be stopped without restart the OS.

Search "Microsoft DDK" for more info

Regards

-- AirCon --