Question

Doing a kernel-driver and every once in a while upon completing the Driver Close subroutine I'll get this bugcheck code.

It seems straightforward as to what exactly is going on, but I'm not sure the most foolproof way to solve it.

Is there a way in the driver unload method to wait for other events to finish, or to cancel them before the driver unload subroutine returns?

EDIT: Just a note: This bugcheck is raised on return - the very last log before the return statement is outputted successfully.

Was it helpful?

Solution

It turns out I had called PsSetLoadImageNotifyRoutine but didn't call PsRemoveLoadImageNotifyRoutine in the driver unload subroutine.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top