Windows listing loaded drivers

Versions History

• Version 1.05:
  • Added ‘Open In RegEdit’ option, which opens the Registry key of the driver in RegEdit.
• Version 1.01:
  • Added secondary sorting support: You can now get a secondary sorting, by holding down the shift key while clicking the column header. Be aware that you only have to hold down the shift key when clicking the second/third/fourth column. To sort the first column you should not hold down the Shift key.
  • Fixed to display local date/time values according to daylight saving time settings.
• Version 1.00 — First release.

Start Using InstalledDriversList

After running it, the main window of InstalledDriversList displays the list of all drivers installed on your system. You can select one or more items (or select all items with Ctrl+A), and then copy them to the clipboard (Ctrl+C) and paste them into Excel or other spreadsheet application. You can also use the ‘Save Selected Items’ option (Ctrl+S) to export the selected items into csv/tab-delimited/xml/html file.

Meaning of green/yellow/red icons

• Green Icon — The driver is running on Windows kernel.
• Yellow Icon — The driver is not running on Windows kernel.
• Red Icon — The driver is not running on Windows kernel, but it should be loaded automatically when Windows starts. When you see a red icon, it’s possible that something is wrong with the driver. Be aware that on Windows 8, there are 2 drivers of the operating system that are normally displayed with red icon.

Command-Line Options

/stext	Save the installed drivers list into a regular text file.
/stab	Save the installed drivers list into a tab-delimited text file.
/scomma	Save the installed drivers list into a comma-delimited text file (csv).
/stabular	Save the installed drivers list into a tabular text file.
/shtml	Save the installed drivers list into HTML file (Horizontal).
/sverhtml	Save the installed drivers list into HTML file (Vertical).
/sxml	Save the installed drivers list into XML file.
/sort	This command-line option can be used with other save options for sorting by the desired column. If you don’t specify this option, the list is sorted according to the last sort that you made from the user interface. The parameter can specify the column index (0 for the first column, 1 for the second column, and so on) or the name of the column, like «Display Name» and «Driver Name». You can specify the ‘

‘ prefix character (e.g: «

Visit Time») if you want to sort in descending order. You can put multiple /sort in the command-line if you want to sort by multiple columns.

Specifying Driver Load Order

For most devices, the physical hierarchy of the devices on a computer determines the order in which Windows and the PnP manager load drivers. Windows and the PnP manager configure devices starting with the system root device, and then they configure the child devices of the root device (for example, a PCI adapter), the children of those devices, and so on. The PnP manager loads the drivers for each device as the device is configured, if the drivers were not previously loaded for another device.

Settings in the INF file can influence driver load order. This topic describes the relevant values that vendors should specify in the service-install-section referenced by a driver’s INF AddService directive. Specifically, this topic discusses the StartType, BootFlags, LoadOrderGroup, and Dependencies entries.

Drivers should follow these rules for specifying StartType:

A PnP driver should have a start type of SERVICE_DEMAND_START (0x3), specifying that the PnP manager can load the driver when the PnP manager finds a device that the driver services.

Driver for a device required to start the computer

If a device is required to start the computer, the drivers for the device should have a start type of SERVICE_BOOT_START (0x0).

Non-boot-start driver that detects device(s) that are not PnP-enumerable

For a device that is not PnP-enumerable, a driver reports the device to the PnP manager by calling IoReportDetectedDevice. Such a driver should have the start type SERVICE_SYSTEM_START (0x01) so Windows will load the driver during system initialization.

Only drivers that report non-PnP hardware should set this start type. If a driver services both PnP and non-PnP devices, it should set this start type.

Non-PnP driver that must be started by the service control manager

Such a driver should have the start type SERVICE_AUTO_START (0x02). PnP drivers must not set this start type.

A PnP driver should be written so that it can be loaded when Windows configures a device that the driver services. Conversely, a driver should be able to be unloaded any time that the PnP manager determines that there are no longer devices present that the driver services. The only driver load orderings that PnP drivers should depend on are as follows:

The drivers for a child device can depend on the fact that the drivers for the parent device are loaded.

A driver in the device stack can depend on the fact that any drivers below it are loaded.

For example, the function driver can be certain that any lower-filter drivers are loaded.

However, be aware that a driver in the device stack cannot depend on being loaded sequentially after a device’s lower drivers, because the driver might are loaded previously when another device was configured.

Filter drivers in a filter group cannot predict their load ordering. For example, if a device has three registered upper-filter drivers, those three drivers will all be loaded after the function driver but could be loaded in any order within their upper-filter group.

If a driver has an explicit load-order dependency on another driver, that dependency should be implemented through a parent/child relationship. A driver for a child device can depend on the drivers for the parent device being loaded before the child drivers are loaded.

To reinforce the importance of setting the correct StartType value, the following list describes how Windows and the PnP manager use the StartType entries in INF files:

On system startup, the operating system loader loads drivers of type SERVICE_BOOT_START before it transfers control to the kernel. These drivers are in memory when the kernel gets control.

Boot-start drivers can use INF LoadOrderGroup entries to order their loading. (Boot-start drivers are loaded before most of the devices are configured, so their load order cannot be determined by device hierarchy.) The operating system ignores INF Dependencies entries for boot-start drivers.

The PnP manager calls the DriverEntry routines of the SERVICE_BOOT_START drivers so the drivers can service the boot devices.

If a boot device has child devices, those devices are enumerated. The child devices are configured and started if their drivers are also boot-start drivers. If a device’s drivers are not all boot-start drivers, the PnP manager creates a device node (devnode) for the device but does not start the device yet.

After all the boot drivers have loaded and the boot devices are started, the PnP manager configures the rest of the PnP devices and loads their drivers.

The PnP manager walks the device tree and loads the drivers for the devnodes that are not yet started (that is, any nonstarted devnodes from the previous step). As each device starts, the PnP manager enumerates the children of the device, if any.

As it configures these devices, the PnP manager loads the drivers for the devices, regardless of the drivers’ StartType values (except when StartType is SERVICE_DISABLED) before proceeding to start the devices. Many of these drivers are SERVICE_DEMAND_START drivers.

The PnP manager ignores registry entries that were created as a result of INF Dependencies entries and LoadOrderGroup entries for drivers that it loads in this step. The load ordering is based on the physical device hierarchy.

At the end of this step, all the devices are configured, except devices that are not PnP-enumerable and the descendants of those devices. (The descendants might or might not be PnP-enumerable.)

The PnP manager loads drivers of StartType SERVICE_SYSTEM_START that are not yet loaded.

These drivers detect and report their non-PnP devices. The PnP manager processes registry entries that are the result of INF LoadOrderGroup entries for these drivers. It ignores registry entries that were created because of INF Dependencies entries for these drivers.

The service control manager loads drivers of StartType SERVICE_AUTO_START that are not yet loaded.

The service control manager processes the service database information with respect to the services’ DependOnGroup and DependOnServices. This information is from Dependencies entries in INF AddService entries. Be aware that the Dependencies information is only processed for non-PnP drivers because any necessary PnP drivers were loaded in an earlier step of system startup. The service control manager ignores INF LoadOrderGroup information.

See the Microsoft Windows SDK documentation for more information about the service control manager.

Using BootFlags to Promote a Driver’s StartType at Boot Depending on Boot Scenario

The operating system can promote a driver’s StartType to be a boot start driver depending on the BootFlags value specified in the driver’s INF. You can specify one or more (ORed) of the following numeric values in the INF file, expressed as a hexadecimal value:

• If a driver should be promoted to be a boot start driver on network boot, specify 0x1 (CM_SERVICE_NETWORK_BOOT_LOAD).
• If a driver should be promoted on booting from a VHD, specify 0x2 (CM_SERVICE_VIRTUAL_DISK_BOOT_LOAD)
• If a driver should be promoted while booting from a USB disk, specify 0x4 (CM_SERVICE_USB_DISK_BOOT_LOAD).
• If a driver should be promoted while booting from SD storage, specify 0x8 (CM_SERVICE_SD_DISK_BOOT_LOAD)
• If a driver should be promoted while booting from a disk on a USB 3.0 controller, specify 0x10 (CM_SERVICE_USB3_DISK_BOOT_LOAD).
• If a driver should be promoted while booting with measured boot enabled, specify 0x20 (CM_SERVICE_MEASURED_BOOT_LOAD).
• If a driver should be promoted while booting with verifier boot enabled, specify 0x40 (CM_SERVICE_VERIFIER_BOOT_LOAD).
• If a driver should be promoted on WinPE boot, specify 0x80 (CM_SERVICE_WINPE_BOOT_LOAD).

For more information about promoting a driver’s StartType at boot, depending on the boot scenario, see INF AddService directive.

Kernel Mode Drivers Manager v1.3

Kernel Mode Drivers Manager is a useful utility which lists all loaded kernel mode drivers running within the system and offers information such as driver load order, driver name, load address, module size, file publisher, file description etc. A one-click save log can also be created making system snapshots simple.

For Windows XP, Vista, 7, 8, 10 (32\64-bit)

List Loaded Windows Drivers

This tool lists all the loaded Windows drivers and shows you many useful information about each loaded driver. View the driver load order, useful to know when a specific kernel-mode driver is loaded in the system and in which order. You can also safely delete a driver on the next reboot.

List Loaded Drivers

List all Windows drivers loaded in the system with useful driver-related details.

Driver Load Order

View the correct Windows driver load order for each loaded driver.

Export Report

You can easily export the list of all loaded Windows drivers on a file.

Very Lightweight

The software application uses only a few MBs of memory, you will not even notice it.

No Spyware\Adware

The program is free from spyware, adware or other pests, nothing extra is installed.

Free to Use

This software is completely free to use for anyone, at home and at work.

Application Screenshots

Here there are some screenshots of the application.

ListDLLs v3.2

By Mark Russinovich

Published: July 4, 2016

Download ListDLLs (307 KB)

Introduction

ListDLLs is a utility that reports the DLLs loaded into processes. You can use it to list all DLLs loaded into all processes, into a specific process, or to list the processes that have a particular DLL loaded. ListDLLs can also display full version information for DLLs, including their digital signature, and can be used to scan processes for unsigned DLLs.

Usage

listdlls [-r] [-v | -u] [processname|pid]
listdlls [-r] [-v] [-d dllname]

Parameter	Description
processname	Dump DLLs loaded by process (partial name accepted).
pid	Dump DLLs associated with the specified process id.
dllname	Show only processes that have loaded the specified DLL.
-r	Flag DLLs that relocated because they are not loaded at their base address.
-u	Only list unsigned DLLs.
-v	Show DLL version information.

Examples

List the DLLs loaded into Outlook.exe, including their version information:

listdlls -v outlook

List any unsigned DLLs loaded into any process:

listdlls -u

Show processes that have loaded MSO.DLL:

listdlls -d mso.dll

Download ListDLLs (307 KB)

Runs on:

• Client: Windows Vista and higher
• Server: Windows Server 2008 and higher
• Nano Server: 2016 and higher

—>