驱动开发：卸载Windows驱动
我正在破解虚拟 HID 驱动程序，由于某种原因，我无法在设备管理器中禁用和卸载该驱动程序。
devcon.exe remove 也会引发错误。在控制面板的游戏控制器对话框中删除设备告诉我转到设备管理器来删除设备。
知道什么可能导致这种情况发生吗？什么可能导致 Windows 认为无法删除驱动程序？
小更新。
将计算机置于待机状态允许我删除该设备。
删除部分 HID 报告描述符（例如多点触控报告、鼠标报告和键盘报告，我都没有使用过）也解决了该问题。
但是，我想了解到底出了什么问题。是什么锁定了驱动程序使其无法卸载？
I'm hacking on a virtual HID driver, and for some reason, I'm unable to disable and unable to uninstall the driver in Device Manager.
devcon.exe remove also throws an error. Removing the device in Game Controllers dialog in Control Panel tells me to go to Device Manager to remove the device.
Any idea what may be causing this to happen? What might cause Windows to think it's unable to remove the driver?
Small update.
Putting the computer to standby allowed me to remove the device.
Removing parts of HID report descriptor (such as the multitouch report, mouse report and keyboard report, neither of which I used) has also fixed the issue.
However, I'd like to understand what exactly went wrong. What has locked down the driver so it cannot be uninstalled?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
任何可能正在使用该驱动程序的进程都可能将其保持打开状态。查看此信息的一种方法是使用 Sysinternals 的 Process Explorer 并使用“Find “Handles”菜单下的“命令搜索与驱动程序相关的任何 DLL 的名称。
因此，对于许多驱动程序来说，关闭相关进程很容易，但对于与文件系统相关的进程来说可能更具挑战性。例如，即使您关闭虚拟设备上的所有映射或安装，任何 Windows 资源管理器进程（包括登录 shell）也可能已加载驱动程序。同样，PROCEXP 对于解决其中的一些问题很有帮助......
Any process that might be using the driver could be holding it open. One way to see this is to use Sysinternals' Process Explorer and use the "Find" command under the "Handles" menu to search for the name of any DLLs related to the driver.
So, for many drivers shutting down the related processes is easy, but it can be more challenging for one related to the file system. For example, even if you close all maps or mounts on the virtual device, any Windows Explorer processes (including the login shell) could have loaded the driver. Again, PROCEXP is helpful for figuring out some of this...
它是一个内核模式驱动程序，因此您不能“仅仅”禁用它。为了成功卸载驱动程序，I/O 管理器必须在没有其他句柄等待处理或关闭时发送清理请求。
如果是 PnP 驱动程序，PnP 管理器必须向 I/O 管理器发送 IRP_MJ_SHUTDOWN 请求，以便 I/O 管理器可以启动卸载回调例程。
强制禁用它的一种方法是，您可以调试机器的内核。通过这样做，您可以看到哪些进程正在向该驱动程序发送请求，然后手动卸载该驱动程序（尽管这可能会产生严重影响，因为所有使驱动程序保持打开状态的打开句柄必须由 I/O 管理器关闭）
It's a kernel-mode driver so, you can't "just" disable it. For a driver to be successfully unload, I/O manager must send the clean up request when there are no other handles waiting to be processed or closed.
And if it is a PnP driver, PnP manager must send
IRP_MJ_SHUTDOWNrequest to the I/O manager so that I/O manager can start the unloading callback routine.One way of disabling it by force could be, you can debug the machine's kernel. By doing that you can see which processes are sending requests to this driver and then manually unload the driver (tho it might have severe effects because all of those open handles that hold the driver open must be closed by the I/O manager)