首页
社区
课程
招聘
[旧帖] [求助]驱动的加载顺序start=3 0.00雪花
发表于: 2009-7-6 17:23 1375

[旧帖] [求助]驱动的加载顺序start=3 0.00雪花

2009-7-6 17:23
1375
驱动在启动的时候将注册表中启动项Start=3,是在什么时候启动这个驱动的?
在loadorder中为什么看不到这类驱动的加载顺序?

[课程]Android-CTF解题方法汇总!

收藏
免费 0
支持
分享
最新回复 (3)
雪    币: 4580
活跃值: (992)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
2
Start=3是程序手动加载
系统不会自动加载的说
2009-7-6 18:02
0
雪    币: 51
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
那要自动加载,怎么办呢?
2009-7-12 19:14
0
雪    币: 74
活跃值: (10)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
4
以下摘自MS$文档:

Driver Start Types

A kernel-mode driver's start type specifies whether the driver is to be loaded during or after system startup. There are five possible start types:

SERVICE_BOOT_START (0x00000000)
Indicates a driver started by the operating system (OS) loader. File system filter drivers commonly use this start type or SERVICE_DEMAND_START. On Microsoft Windows XP and later systems, filters must use this start type in order to take advantage of the new file system filter load order groups.

SERVICE_SYSTEM_START (0x00000001)
Indicates a driver started during OS initialization. This start type is used by the file system recognizer. Except for the file systems listed below under "SERVICE_DISABLED," file systems (including network file system components) commonly use this start type or SERVICE_DEMAND_START. This start type is also used by device drivers for PnP devices that are enumerated during system initialization but not required to load the system.

SERVICE_AUTO_START (0x00000002)
Indicates a driver started by the Service Control Manager during system startup. Rarely used.

SERVICE_DEMAND_START (0x00000003)
Indicates a driver started on demand, either by the PnP Manager (for device drivers) or by the Service Control Manager (for file systems and file system filter drivers).

SERVICE_DISABLED (0x00000004)
Indicates a driver that is not started by the OS loader, Service Control Manager, or PnP Manager. Used by file systems that are loaded by a file system recognizer (except when they are the boot file system) or (in the case of EFS) by another file system. Such file systems include CDFS, EFS, FastFat, NTFS, and UDFS. Also used to temporarily disable a driver during debugging.
2009-7-12 21:23
0
游客
登录 | 注册 方可回帖
返回
//