none
main difference between NT and WDM driver RRS feed

  • Question

  • What's the main difference between these two model?

    I already know that installation method is different and WDM driver has xxxAddDevice routinem, support PnP...

    When will these two models create FDO and assign hardware resources?

    WDM creates FDO by IoCreateDevice routine in xxxAddDevice routine, right?

    and NT Driver creates it in DriverEntry routine?

    but what does assign hardware resources mean? I don't know which part of the codes do this work.



    • Edited by _Wayne56 Wednesday, June 27, 2018 1:44 AM
    Wednesday, June 27, 2018 1:43 AM

Answers

  • The NT driver model preceded the WDM model by about 7 years, and was the original driver model for NT 3.1-4. WDM started as a subset of the NT driver model and then added PnP, Power and WMI support for Win2000. The NT model is still used in some places, such as file system drivers and firewall filters, where PnP/Power/WMI are not needed. WDM has mostly been replaced by WDF (KMDF and UMDF) because of the extreme complexity of WDM and the large amount of "boiler plate" code that you have to provide. In the NT model, the driver looks for its hardware and unloads if it isn't found. In WDM, the driver is loaded only because the hardware is found.

    If you have a choice, then you should use WDF over WDM. It is rare that you would use the NT model.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Wednesday, June 27, 2018 2:43 AM
    Moderator
  • Hardware resources are I/O ports, memory mapped addresses (RAM or device registers), or interrupts that are virtualized (mapped) by Windows and used to access the physical hardware. With very few rare exceptions you have to use WDM, WDF, or one of the other driver models for accessing hardware devices or other hardware resources. Your driver will be told which hardware resources to use by the PnP manager (which got them from the bus driver (usually PCI) for the bus that the device is plugged into. 

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    • Marked as answer by _Wayne56 Wednesday, June 27, 2018 6:34 AM
    Wednesday, June 27, 2018 5:41 AM
    Moderator

All replies

  • The NT driver model preceded the WDM model by about 7 years, and was the original driver model for NT 3.1-4. WDM started as a subset of the NT driver model and then added PnP, Power and WMI support for Win2000. The NT model is still used in some places, such as file system drivers and firewall filters, where PnP/Power/WMI are not needed. WDM has mostly been replaced by WDF (KMDF and UMDF) because of the extreme complexity of WDM and the large amount of "boiler plate" code that you have to provide. In the NT model, the driver looks for its hardware and unloads if it isn't found. In WDM, the driver is loaded only because the hardware is found.

    If you have a choice, then you should use WDF over WDM. It is rare that you would use the NT model.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Wednesday, June 27, 2018 2:43 AM
    Moderator
  • The NT driver model preceded the WDM model by about 7 years, and was the original driver model for NT 3.1-4. WDM started as a subset of the NT driver model and then added PnP, Power and WMI support for Win2000. The NT model is still used in some places, such as file system drivers and firewall filters, where PnP/Power/WMI are not needed. WDM has mostly been replaced by WDF (KMDF and UMDF) because of the extreme complexity of WDM and the large amount of "boiler plate" code that you have to provide. In the NT model, the driver looks for its hardware and unloads if it isn't found. In WDM, the driver is loaded only because the hardware is found.

    If you have a choice, then you should use WDF over WDM. It is rare that you would use the NT model.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    I still do not understand what does assign hardware resources mean...

    Wednesday, June 27, 2018 5:26 AM
  • Hardware resources are I/O ports, memory mapped addresses (RAM or device registers), or interrupts that are virtualized (mapped) by Windows and used to access the physical hardware. With very few rare exceptions you have to use WDM, WDF, or one of the other driver models for accessing hardware devices or other hardware resources. Your driver will be told which hardware resources to use by the PnP manager (which got them from the bus driver (usually PCI) for the bus that the device is plugged into. 

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    • Marked as answer by _Wayne56 Wednesday, June 27, 2018 6:34 AM
    Wednesday, June 27, 2018 5:41 AM
    Moderator