Hi Xiaojiang Gu, it's not so easy...
Both shutdown and reboot follow same sequence in Windows (services stop, drivers unload) and NDIS driver typically receives a MiniportHaltEx call during both ad Windows does not provide an explicit & direct API.
Both are treated as system halt operations from the driver's point of view.
You need a workaround, something like a user‑mode service to write a “Rebooting” registry flag before restart, which the driver reads on unload.
I hope it's helpful to you,
Regards,
S.