Export drivers are basically nothing more than just DLLs with a .sys file extension. Although they have a DriverEntry, this is most likely never being called if the driver gets loaded as the dependency of another driver dynamically linked to it (i.e. importing the export driver’s functions or variables). Not in any case that I am aware of, at least.
Why is that? Normally, if you load a driver, the I/O manager will take care of calling the DriverEntry of your driver. However, the I/O manager is not involved if the driver gets loaded as a dependency Continue reading
