Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

updating/overwriting a driver that uses paged code and is active.

1 view
Skip to first unread message

David F.

unread,
Jan 5, 2010, 11:23:55 PM1/5/10
to
Hi,

Is it safe to updated a driver by simply copying over it when it's loaded in
memory (started) and has paged code sections? I tried to messing things up
by deleting it and seems to work fine. Is there a way I can force a drivers
paged sections to be flushed out of memory to see if it could be a problem?
Or if it's known to be a problem, I can simply check the service status and
not update if it's "started".

TIA!!

Tim Roberts

unread,
Jan 6, 2010, 1:43:44 AM1/6/10
to
"David F." <df2...@community.nospam> wrote:
>
>Is it safe to updated a driver by simply copying over it when it's loaded in
>memory (started) and has paged code sections?

Yes, but doing so has no effect on the loaded driver. You'll have to
unload and reload to get the new bits to take effect.

>I tried to messing things up by deleting it and seems to work fine.

Yes. Unlike user mode DLLs, a kernel mode driver is copied into memory,
not mapped directly to the file. The file is no longer required after
loading.

>Is there a way I can force a drivers
>paged sections to be flushed out of memory to see if it could be a problem?
>Or if it's known to be a problem, I can simply check the service status and
>not update if it's "started".

You can do whatever you want to the file while the driver is loaded. The
new one will take effect when the driver is unloaded. Note that, if you
start up another instance without unloading, the new instance will use the
in-memory image.
--
Tim Roberts, ti...@probo.com
Providenza & Boekelheide, Inc.

Scott Noone

unread,
Jan 6, 2010, 8:29:03 AM1/6/10
to
It's also worth noting that once they're loaded driver images are backed by
the paging file and not the original sys file (you can see a demonstration
of this here: http://analyze-v.com/?p=264).

So, when something from a pageable section gets paged out it is written to
the paging file and read back from the paging file on the next access.

-scott

--
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com


"Tim Roberts" <ti...@probo.com> wrote in message
news:t2c8k5tp8lfuirgps...@4ax.com...

Maxim S. Shatskih

unread,
Jan 6, 2010, 4:23:39 PM1/6/10
to
> Is it safe to updated a driver by simply copying over it when it's loaded in
> memory (started) and has paged code sections?

Yes.

--
Maxim S. Shatskih
Windows DDK MVP
ma...@storagecraft.com
http://www.storagecraft.com

0 new messages