{
	"id": "83f11336-951f-41f2-b806-f6eeac5a7466",
	"created_at": "2026-04-06T02:12:46.1459Z",
	"updated_at": "2026-04-10T03:21:39.484957Z",
	"deleted_at": null,
	"sha1_hash": "99f68a4dc6ce11e1dba1eacfb3d583ae902665d4",
	"title": "EnumDeviceDrivers function (psapi.h) - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51952,
	"plain_text": "EnumDeviceDrivers function (psapi.h) - Win32 apps\r\nBy karl-bridge-microsoft\r\nArchived: 2026-04-06 01:57:49 UTC\r\nRetrieves the load address for each device driver in the system.\r\nBOOL EnumDeviceDrivers(\r\n [out] LPVOID *lpImageBase,\r\n [in] DWORD cb,\r\n [out] LPDWORD lpcbNeeded\r\n);\r\n[out] lpImageBase\r\nAn array that receives the list of load addresses for the device drivers.\r\n[in] cb\r\nThe size of the lpImageBase array, in bytes. If the array is not large enough to store the load addresses, the\r\nlpcbNeeded parameter receives the required size of the array.\r\n[out] lpcbNeeded\r\nThe number of bytes returned in the lpImageBase array.\r\nIf the function succeeds, the return value is nonzero.\r\nIf the function fails, the return value is zero. To get extended error information, call GetLastError.\r\nTo determine how many device drivers were enumerated by the call to EnumDeviceDrivers, divide the resulting\r\nvalue in the lpcbNeeded parameter by sizeof(LPVOID) .\r\nStarting with Windows 7 and Windows Server 2008 R2, Psapi.h establishes version numbers for the PSAPI\r\nfunctions. The PSAPI version number affects the name used to call the function and the library that a program\r\nmust load.\r\nIf PSAPI_VERSION is 2 or greater, this function is defined as K32EnumDeviceDrivers in Psapi.h and exported\r\nin Kernel32.lib and Kernel32.dll. If PSAPI_VERSION is 1, this function is defined as EnumDeviceDrivers in\r\nPsapi.h and exported in Psapi.lib and Psapi.dll as a wrapper that calls K32EnumDeviceDrivers.\r\nPrograms that must run on earlier versions of Windows as well as Windows 7 and later versions should always\r\ncall this function as EnumDeviceDrivers. To ensure correct resolution of symbols, add Psapi.lib to the\r\nTARGETLIBS macro and compile the program with –DPSAPI_VERSION=1. To use run-time dynamic linking,\r\nload Psapi.dll.\r\nhttps://learn.microsoft.com/windows/win32/api/psapi/nf-psapi-enumdevicedrivers\r\nPage 1 of 2\n\nStarting in Windows 11 Version 24H2, EnumDeviceDrivers will require SeDebugPrivilege to return valid\r\nImageBase values. The function will still succeed if the caller does not have this privilege enabled, but the\r\nreturned lpImageBase array will contain addresses that are all NULL.\r\nFor an example, see Enumerating all Device Drivers in the System.\r\nRequirement Value\r\nMinimum\r\nsupported client\r\nWindows XP [desktop apps only]\r\nMinimum\r\nsupported server\r\nWindows Server 2003 [desktop apps only]\r\nTarget Platform Windows\r\nHeader psapi.h\r\nLibrary\r\nKernel32.lib on Windows 7 and Windows Server 2008 R2; Psapi.lib (if\r\nPSAPI_VERSION=1) on Windows 7 and Windows Server 2008 R2; Psapi.lib on\r\nWindows Server 2008, Windows Vista, Windows Server 2003 and Windows XP\r\nDLL\r\nKernel32.dll on Windows 7 and Windows Server 2008 R2; Psapi.dll (if\r\nPSAPI_VERSION=1) on Windows 7 and Windows Server 2008 R2; Psapi.dll on\r\nWindows Server 2008, Windows Vista, Windows Server 2003 and Windows XP\r\nDevice Driver Information\r\nGetDeviceDriverBaseName\r\nGetDeviceDriverFileName\r\nPSAPI Functions\r\nSource: https://learn.microsoft.com/windows/win32/api/psapi/nf-psapi-enumdevicedrivers\r\nhttps://learn.microsoft.com/windows/win32/api/psapi/nf-psapi-enumdevicedrivers\r\nPage 2 of 2\n\nTarget Platform Header Windows psapi.h    \n Kernel32.lib on Windows 7 and Windows Server 2008 R2; Psapi.lib (if\nLibrary PSAPI_VERSION=1) on Windows 7 and Windows Server 2008 R2; Psapi.lib on\n Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP\n Kernel32.dll on Windows 7 and Windows Server 2008 R2; Psapi.dll (if\nDLL PSAPI_VERSION=1) on Windows 7 and Windows Server 2008 R2; Psapi.dll on\n Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP\nDevice Driver Information    \nGetDeviceDriverBaseName     \nGetDeviceDriverFileName     \nPSAPI Functions     \nSource: https://learn.microsoft.com/windows/win32/api/psapi/nf-psapi-enumdevicedrivers     \n   Page 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://learn.microsoft.com/windows/win32/api/psapi/nf-psapi-enumdevicedrivers"
	],
	"report_names": [
		"nf-psapi-enumdevicedrivers"
	],
	"threat_actors": [],
	"ts_created_at": 1775441566,
	"ts_updated_at": 1775791299,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/99f68a4dc6ce11e1dba1eacfb3d583ae902665d4.pdf",
		"text": "https://archive.orkl.eu/99f68a4dc6ce11e1dba1eacfb3d583ae902665d4.txt",
		"img": "https://archive.orkl.eu/99f68a4dc6ce11e1dba1eacfb3d583ae902665d4.jpg"
	}
}