Edit

Share via

ZwLoadDriver function (wdm.h)

  • Article

The ZwLoadDriver routine loads a driver into the system.

Syntax

NTSYSAPI NTSTATUS ZwLoadDriver(
  [in] PUNICODE_STRING DriverServiceName
);

Parameters

[in] DriverServiceName

Pointer to a counted Unicode string that specifies a path to the driver's registry key, \Registry\Machine\System\CurrentControlSet\Services\<DriverName>, where <DriverName> is the name of the driver.

Return value

ZwLoadDriver returns STATUS_SUCCESS or an appropriate error NTSTATUS value.

Remarks

ZwLoadDriver dynamically loads a device or file system driver into the currently running system.

If the system is running in safe mode, and the driver fails to load because it is not on the safe mode list, ZwLoadDriver returns STATUS_SUCCESS.

A minifilter should use FltLoadFilter instead of ZwLoadDriver to load a supporting minifilter.

If the call to the ZwLoadDriver function occurs in user mode, you should use the name "NtLoadDriver" instead of "ZwLoadDriver".

For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

Requirements

Requirement Value
Target Platform Universal
Header wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)
Library NtosKrnl.lib
DLL NtosKrnl.exe
IRQL PASSIVE_LEVEL
DDI compliance rules HwStorPortProhibitedDDIs(storport), PowerIrpDDis(wdm)

See also

FltLoadFilter

RtlInitUnicodeString

UNICODE_STRING

Using Nt and Zw Versions of the Native System Services Routines

ZwUnloadDriver