[r3shl4k1sh]

Using the EnumDeviceDrivers function i get the following weird (to me at least) output:


I get the same results using:

Code: Select all

NtQuerySystemInformation(
					SystemModuleInformation,
					driverList,
					size,
					nullptr);

The program DriverView from NirSoft reports the same files.

When using various ARK tools however i don't see these dlls but more reasonable dlls like BOOTVID.dll and halmacpi.dll.

I would like to know why the system reports these dlls as device drivers?

Thanks.

[BKsky]

EnumDeviceDrivers -> NtQuerySystemInformation, it retreives information from PsLoadedModulesList and MmLoAdedUserImageList
is why functions are adding the user modules too. ARKs retreive directly from PsLoadedModuleList, Driver/device directory