{"id":151,"date":"2007-06-24T20:11:28","date_gmt":"2007-06-24T20:11:28","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2007\/06\/24\/lets-start-again\/"},"modified":"2026-07-25T16:07:18","modified_gmt":"2026-07-25T16:07:18","slug":"lets-start-again","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2007\/06\/24\/lets-start-again\/","title":{"rendered":"Let’s Start Again"},"content":{"rendered":"
\"\"<\/a><\/div>\n

Some drivers need to start as soon as the system loads, I mean, while the system loads. When we set our driver with Start = 0 (Boot)<\/strong>, our driver loads among very basic drivers such as File Systems<\/strong><\/em>, Bus Drivers<\/strong><\/em> and so on. Once, I needed a Boot driver to open a file to get some system information. Unfortunately things like partitions<\/em>, volumes<\/em> and File Systems <\/em>were still not working, so I had to postpone the process a little. In this post, I will comment about how to continue your driver DriverEntry start-up process after the function having ended.<\/p>\n

To illustrate the case, I have written a driver that clearly illustrates this situation. The full project is on a link for downloading at the end of this post. Looking at out DriverEntry<\/em> implementation, we have:<\/p>\n

\n
\/****<\/span><\/pre>\n
***     DriverEntry<\/span><\/pre>\n
**<\/span><\/pre>\n
**      Driver entry point, which will be called while<\/span><\/pre>\n
**      the system Boots (like \"I have just turned my computer on\").<\/span><\/pre>\n
*\/<\/span><\/pre>\n
extern<\/span> \"C\"<\/span> <\/pre>\n
NTSTATUS DriverEntry(IN PDRIVER_OBJECT  pDriverObj,<\/pre>\n
                     IN PUNICODE_STRING pusRegistryPath)<\/pre>\n
{<\/pre>\n
    NTSTATUS    nts;<\/pre>\n
 <\/pre>\n
    \/\/-f--> We're back...<\/span><\/pre>\n
    KdPrint((\"Starting DrvReinit...\\n\"<\/span>));<\/pre>\n
 <\/pre>\n
    \/\/-f--> Register the unload callback routine<\/span><\/pre>\n
    pDriverObj->DriverUnload = OnDriverUnload;<\/pre>\n
 <\/pre>\n
    \/\/-f--> Try to open a file as early as possible, thereafter<\/span><\/pre>\n
    \/\/      I was born within seven months.<\/span><\/pre>\n
    nts = TryOpenFile();<\/pre>\n
 <\/pre>\n
    \/\/-f--> And as you can see...<\/span><\/pre>\n
    if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
    {<\/pre>\n
        \/\/-f--> The file was not opened.<\/span><\/pre>\n
        KdPrint((\"Scheduling reinitialization.\\n\"<\/span>));<\/pre>\n
 <\/pre>\n
        \/\/-f--> And as far as I can imagine, the reason is as it follows:<\/span><\/pre>\n
        ASSERT(nts == STATUS_OBJECT_PATH_NOT_FOUND);<\/pre>\n
 <\/pre>\n
        \/\/-f--> Register OnReinitialize routine so it'll be called later.<\/span><\/pre>\n
        \/\/      In this case, later means whenever all boot drivers have<\/span><\/pre>\n
        \/\/      been loaded.<\/span><\/pre>\n
        IoRegisterBootDriverReinitialization(pDriverObj,<\/pre>\n
                                             OnReinitialize,<\/pre>\n
                                             NULL);<\/pre>\n
    }<\/pre>\n
    else<\/span><\/pre>\n
    {<\/pre>\n
        \/\/-f--> Er... Are you sure you have installed that driver<\/span><\/pre>\n
        \/\/      correctly? Well, your system is not booting now<\/span><\/pre>\n
        \/\/      and you just started your driver manually.<\/span><\/pre>\n
    }<\/pre>\n
 <\/pre>\n
    \/\/-f--> If the DriverEntry routine doesn't return STATUS_SUCCESS,<\/span><\/pre>\n
    \/\/      OnReinitialize will not be called.<\/span><\/pre>\n
    return<\/span> STATUS_SUCCESS;<\/pre>\n
}<\/pre>\n<\/div>\n
IoRegisterBootDriverReinitialization()<\/a> function (Phew! Some of these functions require a breath) registers a callback routine that will be called whenever all boot drivers have been loaded. That will give us a second chance to try to do what has been proposed. This routine is typically used in filters that attach on non-Plug-and-Play<\/strong> devices, and thus, they cannot rely on AddDevice()<\/a> function calling to be notified that a new device was created.<\/p>\n
In our example, the goal is simply to read a file. Accordingly, the error we have received is STATUS_OBJECT_PATH_NOT_FOUND<\/strong>. To ensure that the file you’re about to read actually exists, we will use the actual file where the driver is implemented. Therefore, if our code is running, the file must be there.<\/p>\n
\n
\/****<\/span><\/pre>\n
***\u00a0\u00a0\u00a0\u00a0 TryOpenFile<\/span><\/pre>\n
**<\/span><\/pre>\n
**\u00a0\u00a0\u00a0\u00a0\u00a0 This routine tries to open the file where this driver is implemented.<\/span><\/pre>\n
**\u00a0\u00a0\u00a0\u00a0\u00a0 If this code is running, then this file must be there.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
NTSTATUS TryOpenFile(VOID)<\/pre>\n
{<\/pre>\n
\u00a0\u00a0\u00a0 NTSTATUS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 nts;<\/pre>\n
\u00a0\u00a0\u00a0 IO_STATUS_BLOCK\u00a0\u00a0\u00a0\u00a0 IoStatusBlock;<\/pre>\n
\u00a0\u00a0\u00a0 HANDLE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0 hFile;<\/pre>\n
\u00a0\u00a0\u00a0 OBJECT_ATTRIBUTES\u00a0\u00a0 ObjAttributes;<\/pre>\n
\u00a0\u00a0\u00a0 UNICODE_STRING\u00a0\u00a0\u00a0\u00a0\u00a0 usFilePath =<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RTL_CONSTANT_STRING(L\"\\\\??\\\\C:\\\\Windows\\\\System32\\\\drivers\\\\DrvReinit.sys\"<\/span>);<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Hello debugger...<\/span><\/pre>\n
\u00a0\u00a0\u00a0 KdPrint((\"Trying open the file...\\n\"<\/span>));<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Filling the OBJECT_ATTRIBUTES structure.<\/span><\/pre>\n
\u00a0\u00a0\u00a0 \/\/\u00a0\u00a0\u00a0\u00a0\u00a0 What can I do? It makes part of it.<\/span><\/pre>\n
\u00a0\u00a0\u00a0 InitializeObjectAttributes(&ObjAttributes,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &usFilePath,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OBJ_CASE_INSENSITIVE,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 NULL,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 NULL);<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Try to open the file.<\/span><\/pre>\n
\u00a0\u00a0\u00a0 nts = ZwCreateFile(&hFile,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 GENERIC_READ,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &ObjAttributes,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &IoStatusBlock,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 NULL,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0<\/span>,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 FILE_SHARE_READ | FILE_SHARE_WRITE,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 FILE_OPEN,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0<\/span>,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 NULL,<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0<\/span>);<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0 \/\/-f--> Did it open or not?<\/span><\/pre>\n
\u00a0\u00a0\u00a0 if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
\u00a0\u00a0\u00a0 {<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/-f--> I'm sorry, maybe next time.<\/span><\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 KdPrint((\"Error 0x%08x opening the file.\\n\"<\/span>, nts));<\/pre>\n
\u00a0\u00a0\u00a0 }<\/pre>\n
\u00a0\u00a0\u00a0 else<\/span><\/pre>\n
\u00a0\u00a0\u00a0 {<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/-f--> So, it wasn't that hard.<\/span><\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 KdPrint((\"File opened OK. Er... So, let's close it now.\\n\"<\/span>));<\/pre>\n
\u00a0<\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/-f--> Close the file handle. We want nothing from it anyway.<\/span><\/pre>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ZwClose(hFile);<\/pre>\n
\u00a0\u00a0\u00a0 }<\/pre>\n
\u00a0\u00a0\u00a0 return<\/span> nts;<\/pre>\n
}<\/pre>\n<\/div>\n
Initially, when we had tried to open this file from DriverEntry<\/em> function and the error returned, indicating that it does not exist, we can fall into an existential crisis. After all, if the file has not existed, how was the driver loaded? Doesn’t the driver exist? Don’t I exist? Other crises could be mentioned as the well-known ones:<\/p>\n
\n
“God is love.
\n The love is blind.
\n Steve Wonder is blind.
\n So, Steve Wonder is God.<\/em><\/p>\n
 <\/em><\/p>\n
Someone told me I’m no one.
\n No one is perfect.
\n So, I am perfect.
\n But only God is perfect.
\n So, I am God.<\/em><\/p>\n
 <\/em><\/p>\n
 If Steve Wonder is God, I am Steve Wonder!
\n My God, I am blind!”<\/em><\/p>\n<\/blockquote>\n
But back to the subject, if the re-initialization routine is executed and the service that the driver needs is not yet available, so we can re-schedule this routine calling once again (or as many times as necessary). One of the parameters that re-initialization routine receives is the one which tells you how many times it had been called by the system. This could be used to give up on the resource that never appears when the thousandth attempt has failed. Follow our routine sample:<\/p>\n
\n
\/****<\/span><\/pre>\n
***     OnReinitialize<\/span><\/pre>\n
**<\/span><\/pre>\n
**      This routine is registered by the IoRegisterBootDriverReinitialization <\/span><\/pre>\n
**      routine to be called later.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
VOID OnReinitialize(IN PDRIVER_OBJECT     pDriverObj,<\/pre>\n
                    IN PVOID              pContext,<\/pre>\n
                    IN ULONG              ulCount)<\/pre>\n
{<\/pre>\n
    NTSTATUS    nts;<\/pre>\n
 <\/pre>\n
    \/\/-f--> This routine can be rescheduled as many times as necessary.<\/span><\/pre>\n
    \/\/      Let's show how many it's been so far.<\/span><\/pre>\n
    KdPrint((\"OnReinitialize was called %d times...\\n\"<\/span>, ulCount));<\/pre>\n
 <\/pre>\n
    \/\/-f--> If this commentary did not exist, you would never know<\/span><\/pre>\n
    \/\/      the following routine would try open a file.<\/span><\/pre>\n
    nts = TryOpenFile();<\/pre>\n
 <\/pre>\n
    \/\/-f--> So, did it work?<\/span><\/pre>\n
    if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
    {<\/pre>\n
        \/\/-f--> If the error code is different from the one below, so<\/span><\/pre>\n
        \/\/      I know nothing about it. It is not my fault. I don't even know you.<\/span><\/pre>\n
        ASSERT(nts == STATUS_OBJECT_PATH_NOT_FOUND);<\/pre>\n
 <\/pre>\n
        \/\/-f--> It can't be true. This is not actually happening.<\/span><\/pre>\n
        \/\/      Let's try again a bit latter.<\/span><\/pre>\n
        IoRegisterBootDriverReinitialization(pDriverObj,<\/pre>\n
                                             OnReinitialize,<\/pre>\n
                                             NULL);<\/pre>\n
    }<\/pre>\n
}<\/pre>\n<\/div>\n
Installing a Boot driver<\/h3>\n
To ensure that we have a need to delay our driver start-up, we will make our sample driver be the first one to be loaded. For this, we use the aforementioned DriverLoader<\/a> to install it on a specific group.<\/p>\n
After compiling the sample code, copy the driver to the victim machine’s System32\\drivers<\/em> directory. Run DriverLoader, fill up the fields as demonstrated below and click on RegisterService<\/em>.<\/p>\n
\"\"<\/div>\n
To complete the experience, we will restart the system and connect the kernel debugger to follow ahead. We should have the following output.<\/p>\n
\"\"<\/div>\n
But couldn’t we use a work item for this?<\/strong> Actually, yes, but there are subtle differences between these alternatives. Using  a Work Item cannot guarantee that the routine is not being executed before  DriverEntry<\/em> finishes, and obviously it does not ensure that it runs only  after all the boot drivers has been loaded.<\/p>\n
See you next time… \ud83d\ude09<\/p>\n
DrvReinit.zip<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Some drivers need to start as soon as the system loads, I mean, while the system loads. When we set our driver with Start = 0 (Boot), our driver loads among very basic drivers such as File Systems, Bus Drivers and so on. Once, I needed a Boot driver to open a file to get […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-151","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/comments?post=151"}],"version-history":[{"count":1,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/151\/revisions"}],"predecessor-version":[{"id":152,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/151\/revisions\/152"}],"wp:attachment":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/media?parent=151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/categories?post=151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/tags?post=151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}