Introduction to Registry Keys for Drivers-windows驱动的注册表位置

问题：

   一个内核驱动，在卸载（XxxxCleanup）函数中故意制造了一个致命错误，每次Disable该驱动的时候会引发死机BSoD，现在想卸载这个驱动了，结果杯具了，每次Unstall的时候都会死机，也就是说你无法通过正常方法卸载它了。。。。

    方法一：直接在属性中找到驱动位置，去删除它，但是因为文件在使用中，无法删除。。。

   方法二：删除该驱动的注册表。内核驱动的注册表位置就是下面所说的HKLM\SYSTEM\CurrentControlSet\Services 中，直接删除想要卸载的驱动项，重启。重启之后，在硬件管理中还是会有想要卸载的驱动，不过已经是个带有叹号的驱动了，现在可以卸载它了。

   方法三：通过电脑管家之类的软件取消开机加载驱动，然后删除就可以了。（待测试）

---------------

---

https://docs.microsoft.com/zh-tw/windows-hardware/drivers/wdf/introduction-to-registry-keys-for-drivers

Drivers typically use a set of system-defined registry keys to store or access driver-specific or device-specific information. Your driver might access the following registry keys:

• Parameters key

  The driver's Parameters key can contain configuration information for your driver. For Kernel-Mode Driver Framework (KMDF) drivers, this key is located in the HKLM\SYSTEM\CurrentControlSet\Services tree, under the driver's service name. For User-Mode Driver Framework (UMDF) drivers, this key is located in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services tree, under the driver's service name. The subkey for the driver always uses the driver's service name, even if the driver binary's file name differs from the service name.

  When the system calls your driver's DriverEntry routine, it passes the driver a path to the driver's Services tree. Your driver must pass this path to WdfDriverCreate. Subsequently, the driver can obtain the path by calling WdfDriverGetRegistryPath, and the driver can open its Parameterskey by calling WdfDriverOpenParametersRegistryKey.

  For more information about the Parameters key, see The HKLM\SYSTEM\CurrentControlSet\Services Tree.

• Software key

  A driver's software key is also called its driver key because the registry contains a software key for each driver. The registry contains a list of all of the device classes, and each driver's software key resides under its device class entry. The system stores information about each driver under its software key.

  Your driver can call WdfFdoInitOpenRegistryKey and WdfDeviceOpenRegistryKey to open its software key.

  For more information about software keys, see The HKLM\SYSTEM\CurrentControlSet\Control Tree.

• Hardware keys

  When a driver stack informs the Plug and Play (PnP) manager that a device is connected to the system, the PnP manager creates a hardware key for the device. This key is also called a device key. The PnP manager stores each device's unique identification information under the device's hardware key.

  Your driver can call WdfFdoInitOpenRegistryKey and WdfDeviceOpenRegistryKey to open a device's hardware key.

  For more information about hardware keys, see The HKLM\SYSTEM\CurrentControlSet\Enum Tree.

Your driver's INF file can contain INF AddReg directives that set registry values. INF files typically use INF DDInstall.HW sections to set information under a device's hardware key.

To determine whether your driver type requires that you store information under specific registry keys, see the sections of this documentation that discuss your driver's device type by using the table of contents.

For more information about registry keys for drivers, see:

• Overview of Registry Trees and Keys

• Using the Registry in a Driver