Search code examples
windowswindows-servicesdevice-driversmb

Device Driver's ImagePath

I always set my drivers Imagepath directly.(C:\Windows\System32\drivers\abc.sys)

But I just knew many device drivers set their ImagePath to %SystemRoot%\system32\svchost.exe -k netsvcs
enter image description here
This is Lanmanworkstation driver's registry hive.
I guess Lanmanworkstation driver's image file is mrxsmb.sys
But they didn't put 'System32\drivers\mrxsmb.sys'. Why.

What does svchost.exe -k netsvcs mean?
Even though there is no certain path, StartService function works well.
How does Service Manager(? i'm not sure) find the driver's image path?

Is there an advantage using this?
What if I decide to use this way, are there my driver codes should modify?

Solution

  • You are confusing between device drivers and services.
    svchost.exe is used to share the same process between multiple services. The implementation is internal to Windows so use outside of Windows is not supported.

    If you write a device driver (for hardware, or a filter driver) or do not work for Microsoft, you cannot use svchost.

    The reason for the confusion is because old style (NT4), non-plug-and-play drivers can be started using the Service Control Manager APIs.