Fwd: Loading the driver in Safe Mode

NTDEV
1

trying once more…

---------- Forwarded message ----------
From: amitr0
Date: Wed, May 27, 2009 at 5:19 PM
Subject: Loading the driver in Safe Mode
To: Windows System Software Devs Interest List

Hello folks,

I have a WDM driver for a special device class. ALl works well for normal
boot and Driver is loaded, but I need to get this Driver to load for Safe
mode boot as well.

I have added these keys so far…

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{CLASS
GUID}]

@=“DriverBinName”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DriverBinName.sys]

@=“Driver”

However, it doesn’t seem to load the Driver in Vista. I see DriverEntry
returning success but Adddevice not called at all.

Do I need to do somethig else?

–

- amitr0

–

- amitr0

2

amitr0 wrote:

trying once more…

That’s not necessarily a good way to get friendly help.

I have a WDM driver for a special device class. ALl works well for
normal boot and Driver is loaded, but I need to get this Driver to
load for Safe mode boot as well.

I have added these keys so far…

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{CLASS
GUID}]

@=“DriverBinName”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DriverBinName.sys]

@=“Driver”

However, it doesn’t seem to load the Driver in Vista. I see
DriverEntry returning success but Adddevice not called at all.

Who creates the device objects in your custom device class? Is
DriverBinName.sys a legacy bus driver that triggers the creation of
additional devices in your “special” device class? How is
DriverBinName.sys loaded in normal boot?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

tim,

thanks for trying to help…

here are the answers you asked:

Who creates the device objects in your custom device class?

Is DriverBinName.sys a legacy bus driver that triggers the creation of
additional devices in your “special” device class?

[AB]it doesnt trigger other devices, it just creates one device with which
our user mode code communicates. it doesnt have real hardware associated
with it. i will paste the inf for your convenience below.

How is DriverBinName.sys loaded in normal boot?

[AB] here is the INF, let me know if other info is required…

[Version]
Signature=“$WINDOWS NT$”
Class=DriverBinName
ClassGuid={3e503472-4017-4bfb-9446-2d8af547b40a}
Provider=%XXXX%
DriverVer=05/01/2009,5.0.0.4
CatalogFile=DriverBinName.cat
[DestinationDirs]
DefaultDestDir = 12
; ================= Class section =====================
[ClassInstall32]
Addreg=DriverBinNameClassReg
[DriverBinNameClassReg]
HKR,0,%ClassName%
HKR,Icon,-1
HKR,DeviceCharacteristics,0x10001,0x100 ;Use same security checks on
relative opens
HKR,Security,“D:P(A;;GA;;;SY)(A;;GA;;;BA)” ;Allow generic all access to
system and built-in Admin.
;This one overrides the
security set by the driver
;*****************************************
; Manufacturer and Models Sections
;*****************************************
[Manufacturer]
%StdMfg%=XXXXX,ntamd64,ntx86
;include undecorated name because Vista64 is not finding ntamd64
[XXXX]
%DriverBinNameDevice.DeviceDesc%=DriverBinName_Device,
ROOT/XXXX_DriverBinName
[XXXX.ntamd64]
%DriverBinNameDevice.DeviceDesc%=DriverBinName_Device,
ROOT/XXXX_DriverBinName
[XXXX.ntx86]
%DriverBinNameDevice.DeviceDesc%=DriverBinName_Device,
ROOT/XXXX_DriverBinName
;[XXXX.ntia64]
;%DriverBinNameDevice.DeviceDesc%=DriverBinName_Device,
ROOT/XXXX_DriverBinName
;*****************************************
; DriverBinName Device Install Section
;*****************************************
[DriverBinName_Device]
CopyFiles=DriverBinName_Device.Copy
AddReg=DriverBinName_NT_AddReg
[DriverBinName_Device.Copy]
DriverBinName.sys
DriverBinName.dat
DriverBinName2.dat
;-------------- Service installation
[DriverBinName_Device.Services]
AddService = DriverBinName, %SPSVCINST_ASSOCSERVICE%,
DriverBinName_Service_Inst
[DriverBinName_Service_Inst]
DisplayName = %DriverBinName.SVCDESC%
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
StartType = 3 ; SERVICE_DEMAND_START
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
ServiceBinary = %12%\DriverBinName.sys
LoadOrderGroup = Extended Base
[DriverBinName_NT_AddReg]
HKR, “Parameters”, “BreakOnEntry”, 0x00010001, 0
[SourceDisksNames]
1 = %DiskId1%,“”
[SourceDisksFiles]
DriverBinName.sys = 1,
DriverBinName.dat = 1,
DriverBinName2.dat = 1,
[Strings]
SPSVCINST_ASSOCSERVICE= 0x00000002
XXXX = “XXXX Technologies”
StdMfg = “(Standard system devices)”
ClassName = “DriverBinName”
DiskId1 = “DriverBinName Device Installation Disk #1”
DriverBinNameDevice.DeviceDesc = “DriverBinName”
DriverBinName.SVCDESC = “XXXX DriverBinName Device Driver”

On Fri, May 29, 2009 at 3:55 PM, Tim Roberts wrote:

> amitr0 wrote:
> > trying once more…
>
> That’s not necessarily a good way to get friendly help.
>
>
> > I have a WDM driver for a special device class. ALl works well for
> > normal boot and Driver is loaded, but I need to get this Driver to
> > load for Safe mode boot as well.
> >
> > I have added these keys so far…
> >
> >
> >
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{CLASS
> > GUID}]
> >
> > @=“DriverBinName”
> >
> >
> >
> >
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DriverBinName.sys]
> >
> > @=“Driver”
> >
> >
> > However, it doesn’t seem to load the Driver in Vista. I see
> > DriverEntry returning success but Adddevice not called at all.
>
> Who creates the device objects in your custom device class? Is
> DriverBinName.sys a legacy bus driver that triggers the creation of
> additional devices in your “special” device class? How is
> DriverBinName.sys loaded in normal boot?
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–

- amitr0

4

amitr0 wrote:

thanks for trying to help…

here are the answers you asked:

>Who creates the device objects in your custom device class?

>Is DriverBinName.sys a legacy bus driver that triggers the creation of
additional devices in your “special” device class?

[AB]it doesnt trigger other devices, it just creates one device with
which our user mode code communicates. it doesnt have real hardware
associated with it. i will paste the inf for your convenience below.

> How is DriverBinName.sys loaded in normal boot?

[AB] here is the INF, let me know if other info is required…

Ah, so, this is a root-enumerated PnP device. By adding your driver’s
name to SafeBoot\Minimal, I believe you are saying that your driver is a
legacy driver. Hence, DriverEntry is called, but no AddDevice. In
order for a PnP device to get loaded, someone has to create a PDO for
your device, so that your driver can be loaded (using the
SafeBoot\Minimal{classGUID}).

I don’t know how root-enumerated devices are triggered in safe mode, or
if they can be at all. Hopefully, someone else can take over this exchange.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

so tim, are you saying that the root bus driver has been removed in vista
safe mode boot for “maybe” security reasons?

On Mon, Jun 1, 2009 at 2:20 PM, Tim Roberts wrote:

> amitr0 wrote:
> >
> > thanks for trying to help…
> >
> > here are the answers you asked:
> >
> > >Who creates the device objects in your custom device class?
> >
> > >Is DriverBinName.sys a legacy bus driver that triggers the creation of
> > additional devices in your “special” device class?
> >
> > [AB]it doesnt trigger other devices, it just creates one device with
> > which our user mode code communicates. it doesnt have real hardware
> > associated with it. i will paste the inf for your convenience below.
> >
> > > How is DriverBinName.sys loaded in normal boot?
> >
> > [AB] here is the INF, let me know if other info is required…
>
> Ah, so, this is a root-enumerated PnP device. By adding your driver’s
> name to SafeBoot\Minimal, I believe you are saying that your driver is a
> legacy driver. Hence, DriverEntry is called, but no AddDevice. In
> order for a PnP device to get loaded, someone has to create a PDO for
> your device, so that your driver can be loaded (using the
> SafeBoot\Minimal{classGUID}).
>
> I don’t know how root-enumerated devices are triggered in safe mode, or
> if they can be at all. Hopefully, someone else can take over this
> exchange.
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–

- amitr0

6

amitr0 wrote:

so tim, are you saying that the root bus driver has been removed in
vista safe mode boot for “maybe” security reasons?

Not at all – you are reading VASTLY more into my statement than what I
really said. I’m saying I don’t KNOW how (or whether) root enumeration
works in safe mode. I said that in the hopes that someone who DOES know
will respond.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.