Kernel Shutdown

Kernel Shutdown

#include"ntddk.h"

enum FIRMWARE_REENTRY
{
    HalHaltRoutine,
    HalPowerDownRoutine,
    HalRestartRoutine,
    HalRebootRoutine,
    HalInteractiveModeRoutine,
    HalMaximumRoutine
} FIRMWARE_REENTRY, *PFIRMWARE_REENTRY;

VOID HalReturnToFirmware(
  IN enum FIRMWARE_REENTRY  Routine
);

NTSTATUS DriverEntry(
    PDRIVER_OBJECT pDriver,
    PUNICODE_STRING uReg)
{
    HalReturnToFirmware(HalPowerDownRoutine);
    return STATUS_SUCCESS;
}

HalReturnToFirmware是Hal.dll導出的一個函數，即位於內核層中的硬件抽象層(Hardware Abstraction Layer)。MSDN上說此函數只有HalRebootRoutine一個值有效，但是我發現HalPowerDownRoutine也是有效的，win7 x86，win x64，win10 x64測試成功。

DDK 7600編譯成功