Detect Net Stop

Hi,

How does a driver detect a "net stop" request (if possible)?

TIA!!

If you mean the command NET STOP <driver service> the driver will get a call
to the unload routine for a legacy driver, for a PNP driver this command
does not work.


--
Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply



"David F." <> wrote in message
news:3EEF0CD9-6FC7-40E9-8FD2-...
> Hi,
>
> How does a driver detect a "net stop" request (if possible)?
>
> TIA!!
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 4730 (20091230) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>



__________ Information from ESET NOD32 Antivirus, version of virus signature database 4730 (20091230) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

Well, it's weird to me ... when I "net stop drivername" and my device
doesn't have any handles of its own open everything seems to work well. If
my driver/device has an open handle (or something like that) the net stop
hangs for a while then says it can't do it. From then on I assume it's
STOP_PENDING state but unload was never called (this is XP) ? what would
clear the stop_pending .. how does the service control manager determine if
it can stop it or not?


"Don Burn" <> wrote in message
news:...
> If you mean the command NET STOP <driver service> the driver will get a
> call to the unload routine for a legacy driver, for a PNP driver this
> command does not work.
>
>
> --
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
> Remove StopSpam to reply
>
>
>
> "David F." <> wrote in message
> news:3EEF0CD9-6FC7-40E9-8FD2-...
>> Hi,
>>
>> How does a driver detect a "net stop" request (if possible)?
>>
>> TIA!!
>>
>>
>> __________ Information from ESET NOD32 Antivirus, version of virus
>> signature database 4730 (20091230) __________
>>
>> The message was checked by ESET NOD32 Antivirus.
>>
>> http://www.eset.com
>>
>>
>>
>
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 4730 (20091230) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
>

You can't use NET STOP on a driver that has open handles to its devices. If
there are references to the DEVICE_OBJECTS you will not be able to stop the
driver.


--
Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply



"David F." <> wrote in message
news:...
> Well, it's weird to me ... when I "net stop drivername" and my device
> doesn't have any handles of its own open everything seems to work well.
> If my driver/device has an open handle (or something like that) the net
> stop hangs for a while then says it can't do it. From then on I assume
> it's STOP_PENDING state but unload was never called (this is XP) ? what
> would clear the stop_pending .. how does the service control manager
> determine if it can stop it or not?
>
>
> "Don Burn" <> wrote in message
> news:...
>> If you mean the command NET STOP <driver service> the driver will get a
>> call to the unload routine for a legacy driver, for a PNP driver this
>> command does not work.
>>
>>
>> --
>> Don Burn (MVP, Windows DKD)
>> Windows Filesystem and Driver Consulting
>> Website: http://www.windrvr.com
>> Blog: http://msmvps.com/blogs/WinDrvr
>> Remove StopSpam to reply
>>
>>
>>
>> "David F." <> wrote in message
>> news:3EEF0CD9-6FC7-40E9-8FD2-...
>>> Hi,
>>>
>>> How does a driver detect a "net stop" request (if possible)?
>>>
>>> TIA!!
>>>
>>>
>>> __________ Information from ESET NOD32 Antivirus, version of virus
>>> signature database 4730 (20091230) __________
>>>
>>> The message was checked by ESET NOD32 Antivirus.
>>>
>>> http://www.eset.com
>>>
>>>
>>>
>>
>>
>>
>> __________ Information from ESET NOD32 Antivirus, version of virus
>> signature database 4730 (20091230) __________
>>
>> The message was checked by ESET NOD32 Antivirus.
>>
>> http://www.eset.com
>>
>>
>>
>>
>
>
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 4730 (20091230) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>



__________ Information from ESET NOD32 Antivirus, version of virus signature database 4730 (20091230) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

> my driver/device has an open handle (or something like that) the net stop
> hangs for a while then says it can't do it.

Correct.

>From then on I assume it's
> STOP_PENDING state but unload was never called (this is XP) ?

Correct.

> clear the stop_pending .. how does the service control manager determine if
> it can stop it or not?

It cannot. Only PnP can.

And, even PnP will leave you with half-destroyed devnode if there are open handles to it. Usually, the apps register for "please close this handle - the driver is unloading" situation, but not always.

--
Maxim S. Shatskih
Windows DDK MVP

http://www.storagecraft.com