NtLoadDriver - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTIOAPI_H

/**
 * The NtLoadDriver function loads a driver specified by the DriverServiceName parameter.
 * 
 * \param DriverServiceName A pointer to a UNICODE_STRING structure that specifies the name of the driver service to load.
 * \return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadDriver(
    _In_ PCUNICODE_STRING DriverServiceName
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwLoadDriver(
    _In_ PCUNICODE_STRING DriverServiceName
    );

#endif

View code on GitHub
// wdm.h

NTSYSAPI NTSTATUS ZwLoadDriver(
  [in] PUNICODE_STRING DriverServiceName
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-wdm-zwloaddriver)

Description

The ZwLoadDriver routine loads a driver into the system.

Parameters

DriverServiceName [in]

Pointer to a counted Unicode string that specifies a path to the driver's registry key, \Registry\Machine\System\CurrentControlSet\Services\\<*DriverName*>, where <*DriverName*> is the name of the driver.

Return value

ZwLoadDriver returns STATUS_SUCCESS or an appropriate error NTSTATUS value.

Remarks

ZwLoadDriver dynamically loads a device or file system driver into the currently running system.

If the system is running in safe mode, and the driver fails to load because it is not on the safe mode list, ZwLoadDriver returns STATUS_SUCCESS.

A minifilter should use FltLoadFilter instead of ZwLoadDriver to load a supporting minifilter.

If the call to the ZwLoadDriver function occurs in user mode, you should use the name "NtLoadDriver" instead of "ZwLoadDriver".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

FltLoadFilter

RtlInitUnicodeString

UNICODE_STRING

Using Nt and Zw Versions of the Native System Services Routines

ZwUnloadDriver

View the official Windows Driver Kit DDI reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit.

DriverServiceName

Registry path in system format. Path must begin with "\registry\machine\SYSTEM\CurrentControlSet\Services\..." where "..." is driver symbolic name.
Key must have at least 2 values:

Requirements

Privilege: SeLoadDriverPrivilege

See also

Edit description on GitHub