A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #13373  by frank_boldewin
 Wed May 23, 2012 6:04 am
// 0 == OS is not in Safe Mode.
// 1 == SAFEBOOT_MINIMAL
// 2 == SAFEBOOT_NETWORK
// 3 == SAFEBOOT_DSREPAIR

extern PULONG InitSafeBootMode;

if (*InitSafeBootMode > 0) {
// OS is in SafeMode
}

Notes:

To prevent a driver from operating in Safe Mode, use the technique in the following list that matches your driver type:

Function drivers

If your function driver has a service start type of SERVICE_BOOT_START, check the value of InitSafeBootMode in the function driver's AddDevice routine. If the system is in Safe Mode, return a failure status.

Filter drivers

If your filter driver starts during system startup, check the value of InitSafeBootMode in the filter driver's AddDevice routine. If the operating system is in Safe Mode, do the following:

Do not attach the filter device object to the device stack.
Return success from the filter driver's AddDevice routine.

All other drivers

For drivers other than function or filter drivers, check the value of InitSafeBootMode in the driver's DriverEntry routine. If the operating system is in Safe Mode, return a failure status.