Listing drivers in ring0/kernel?

Question

Just a question, I'm wondering if it's possible to hook in to Ring0/Kernel to display the list of loaded drivers running within the kernel? Would I need to write a driver to do so?

Similar to how you can list all the running processes quite easily.

Oh and this is in C++ / Windows.

Answer 1

As I've commented, use the driverquery command.

driverquery
Display a list of all installed device drivers and their properties.

Syntax

driverquery  [/s Computer] [/u Domain\User /p Password]
         [/fo {TABLE|LIST|CSV}] [/nh] [/v] [/si]
example

Show all installed device drivers in Table output:
driverquery

Show all installed device drivers in a CSV format:
DriverQuery /fo csv

Without a header:
DriverQuery /nh

Drivers that are not signed:
DriverQuery /si | findstr FALSE

Find drivers that are currently Running:
Driverquery.exe /v |findstr Running

Show installed device drivers on a remote machine
driverquery /s ipaddress

Show installed device drivers on server64 and authenticate as a different user:
driverquery /s server64 /u ss64Ddom\user123 /p p@sswor3d /fo list

Export a verbose listing of drivers to a file
driverquery /v /fo csv > T:\driverlist.csv

When running DriverQuery within PowerShell, the CSV output format can be used to turn the output into objects. The PowerShell function below turns DriverQuery into a graphical tool that will list drivers from both local and remote systems (assuming you have the appropriate permissions.)

function Show-DriverDialog {
    param(
        $ComputerName = $env:computername
    )

    driverquery.exe /S $ComputerName /FO CSV  | 
      ConvertFrom-Csv | 
      Out-GridView -Title "Driver on \\$ComputerName"

Source: http://windows.commands.com/driverquery

Special attention to:

Find drivers that are currently Running:
Driverquery.exe /v | findstr Running

Answer 2

If you REALLY want to write your own code for this, then here's a "Device Driver Information" page on Microsfts website.

From that, you should be able to pull together the pieces (it's pretty similar to listing the currently running processes).