How to determine whether the system is running in Safe Mode from a device driver (837643)

MORE INFORMATION

The Windows OS kernel exports a pointer to a ULONG variable that is named InitSafeBootMode. This variable contains the Safe Mode settings.

A device driver can determine whether the system is running in Safe Mode by the value of the InitSafeBootMode variable. A value of 0 means that the system is not running in Safe Mode.

The following table lists the modes for other values.

Value	Mode
1	SAFEBOOT_MINIMAL
2	SAFEBOOT_NETWORK
3*	SAFEBOOT_DSREPAIR

*Note The value of 3 applies to Windows domain controllers only.

You must declare the following in your driver.

extern PULONG InitSafeBootMode; 

You must check the value of InitSafeBootMode to determine whether the system is running in Safe Mode.

if (*InitSafeBootMode > 0){ 

     // The system is in Safe Mode. 
     // Take appropriate action. 
     //     
} 

For example, to prevent a driver from working in Safe Mode, use one of the following methods:

• Function drivers
  
  If your function driver has a service start type of SERVICE_BOOT_START, check the value of the InitSafeBootMode variable in the AddDevice routine and return failure.
  
  Note You must never return failure from the DriverEntry routine.
• Filter drivers
  
  If your filter driver starts during boot time, check the value of the InitSafeBootMode variable in the AddDevice routine. Do not attach to the device stack. Return success from the AddDevice routine.
• Other drivers
  
  For drivers that are not mentioned earlier, check the value of the InitSafeBootMode variable in the DriverEntry routine. Return failure if the system is in Safe Mode.