Where do I find the device drivers in the task manager?

Question

While running an OS all the drivers of keyboard, mouse, graphic card, nic must be in memory in order to be accessed by the CPU, right?

Each driver should be a process or at least a thread of a system process, right?

But where do I find them, how are they called in the task manager under Windows 7?

Solution 1

Every used driver used by the system are loaded and are running over "System" process.

You can find all drivers that are loaded with Device Manager. If you want to see all drivers loaded, open your windows device manager, go to "Show" tab and select "Show hidden devices", you will be able to see all drivers installed on your system.

Solution 2

"Each driver should be a process or at least a thread of a system process, right?"

Sorry, no, that isn't true. The "System" process does run some code on behalf of some drivers, but not for most drivers. Aside from a few specifically created "system threads" or "kernel threads", drivers do not run in processes or threads of their own.

Process Explorer will show them to you. Select the "System" process, then View | Show Lower Pane, then View | Lower Pane View | DLLs. In general every module called anything.sys is a kernel mode driver. If you enable the "Base" (address) column you'll see that they're all up in kernel address space.

Solution 3

I would just find them in Device Manager. They might be part of the kernel in any case.

Comments

[Keltari]

What information are you trying to get exactly?

[user1686]

Additionally, if you set the DEVMGR_SHOW_NONPRESENT_DEVICES environment variable to 1, Device Manager will display devices that are installed but not connected, too.

[JohnnyFromBF]

Thanks go out to Diogo_Rocha, I used as software called procexp.exe to display this, you can have a look here, you can see all the drivers under the System process, but only 140 KB??? img713.imageshack.us/img713/6480/procexp.jpg Tastatur = Keyboard

[Diogo]

Nice, I already used this program, but I didnt remember when posting the answear. Glad to help you :D

[JohnnyFromBF]

@grawity: Do you know how I could have a look at the kernel memory, is there a tool like procexp?

[user1686]

@Ian: Does the "System information" menu item help?

[user1686]

@Ian: You cannot create a memory dump of the kernel (which the 'System' process represents). This is for security reasons; unlike root, an administrator is not fully-privileged.

[Jamie Hanrahan]

Sorry but this answer is mostly wrong, as are many of the comments. The so-called "System" process isn't anything like the entire operating system, that process does not represent "the kernel", and most drivers don't have threads in the System process. The memory used by drivers is mostly in nonpaged pool. And, you CAN look at kernel memory you can use WinDbg either with the built-in local kernel debugging option or with the sysinternals tool livekd. The lm command will give you a complete list of kernel mode modules, including all of the drivers.

[intika]

Nice answer... ProcessHacker have a service tab that show all loaded driver and you can play with them change their start, stop them etc...

[Jamie Hanrahan]

Fine, but kernel mode drivers are still not processes or threads. See the "Type" column?