3

While running an OS all the drivers of keyboard, mouse, graphic card, nic must be in memory in order to be accessed by the CPU, right?

Each driver should be a process or at least a thread of a system process, right?

But where do I find them, how are they called in the task manager under Windows 7?

1
  • What information are you trying to get exactly?
    – Keltari
    Aug 22, 2011 at 17:37

3 Answers 3

1

Every used driver used by the system are loaded and are running over "System" process.

You can find all drivers that are loaded with Device Manager. If you want to see all drivers loaded, open your windows device manager, go to "Show" tab and select "Show hidden devices", you will be able to see all drivers installed on your system.

9
  • 1
    Additionally, if you set the DEVMGR_SHOW_NONPRESENT_DEVICES environment variable to 1, Device Manager will display devices that are installed but not connected, too. Aug 22, 2011 at 18:16
  • Thanks go out to Diogo_Rocha, I used as software called procexp.exe to display this, you can have a look here, you can see all the drivers under the System process, but only 140 KB??? img713.imageshack.us/img713/6480/procexp.jpg Tastatur = Keyboard Aug 22, 2011 at 18:24
  • Nice, I already used this program, but I didnt remember when posting the answear. Glad to help you :D
    – Diogo
    Aug 22, 2011 at 18:28
  • @Ian: That number does not include the kernel memory. Aug 22, 2011 at 19:47
  • @grawity: Do you know how I could have a look at the kernel memory, is there a tool like procexp? Aug 22, 2011 at 21:02
4

"Each driver should be a process or at least a thread of a system process, right?"

Sorry, no, that isn't true. The "System" process does run some code on behalf of some drivers, but not for most drivers. Aside from a few specifically created "system threads" or "kernel threads", drivers do not run in processes or threads of their own.

Process Explorer will show them to you. Select the "System" process, then View | Show Lower Pane, then View | Lower Pane View | DLLs. In general every module called anything.sys is a kernel mode driver. If you enable the "Base" (address) column you'll see that they're all up in kernel address space.

2
  • Nice answer... ProcessHacker have a service tab that show all loaded driver and you can play with them change their start, stop them etc...
    – intika
    Apr 1, 2017 at 5:39
  • Fine, but kernel mode drivers are still not processes or threads. See the "Type" column? Apr 1, 2017 at 7:06
2

I would just find them in Device Manager. They might be part of the kernel in any case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .