Re: [PATCH v4] ntoskrnl.exe: Implement ZwLoadDriver and ZwUnloadDriver

[Sebastian Lackner]

On 24.01.2016 05:58, Alexandre Julliard wrote:
> Aric Stewart  writes:
> > I would love to head Alexandre chime in on this. I could go either
> > way. In our private discussions he lead me toward ZwLoadDriver but
> > maybe I misunderstood and I can move this to NtLoadDriver if that is
> > what is better.
>
> There's no NtLoadDriver in ntoskrnl, which makes sense given its
> purpose. I don't think we want to invent our own.
>
> There's NtLoadDriver in ntdll, but its behavior should of course be
> different, it's meant to be called from userspace instead of kernel
> space.

Thanks for pointing this out, I wasn't aware that NtLoadDriver is not
accessible from kernel mode.