Kernel-Mode Routines That are Discouraged for All NDIS Drivers

Article
06/19/2017

WHQL allows NDIS drivers to call the following kernel-mode support routines, but their use is discouraged. If possible, do not implement your NDIS driver by using these functions, because future versions of WHQL test kits might restrict their use.

Restricted routine	Error message
IoOpenDeviceRegistryKey	Use NdisOpenConfiguration. If accessing some other key, please take care to validate all input and output.
RtlDeleteRegistryValue	Writing to the registry can potentially introduce security issues. NdisWriteConfigurationmight help.
RtlWriteRegistryValue	Writing to the registry can potentially introduce security issues. NdisWriteConfigurationmight help.
ZwCreateDirectoryObject	File I/O from driver can potentially introduce security issues. Avoid if possible.
ZwCreateKey	Writing to registry can potentially introduce security issues. Avoid if possible.
ZwDeleteKey	Writing to the registry can potentially introduce security issues. Avoid if possible.
ZwQueryInformationFile	Try using NdisMapFile, NdisUnmapFileinstead.
ZwReadFile	Refer to DKK for use of NdisMapFile, NdisUnmapFileinstead.
ZwSetValueKey	Writing to the registry can potentially introduce security issues. Try using NdisWriteConfiguration.

Send comments about this topic to Microsoft