A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #33048  by 0xdeadc0de
 Thu Jul 04, 2019 10:17 pm
Hello, I am writing an anti-rootkit tool that has the functionality of force unload on suspect drivers, how to do a force unload driver by kernel?
 #33149  by EP_X0FF
 Wed Aug 14, 2019 3:47 am
Just do BSOD. Force unloads everything.
The feature you are planning is BSOD generator by design. There is no way to safely unload driver if it not support unloading itself, otherwise just call it driver unload function and pray for no BSOD.