So it turns out I accidentally made a WDM driver. I’ve since started porting what I wrote to WDF. However I can’t figure out how to make the driver unloadable, as in:
sc.exe create Service binPath= C:\Driver.sys type= kernel
sc.exe start Service
(Service loads properly.)
sc.exe stop Service
[SC] ControlService FAILED 1052:
The requested control is not valid for this service.
You can’t use sc to load/unload a pnp driver. You need to use setup apis to enable/disable the device. For a non pnp, attach a debugger and start debugging…
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Saturday, April 1, 2017 12:45 AM
To: Windows System Software Devs Interest List Subject: [ntdev] Unable to make WDF driver unloadable.
So it turns out I accidentally made a WDM driver. I’ve since started porting what I wrote to WDF. However I can’t figure out how to make the driver unloadable, as in:
sc.exe create Service binPath= C:\Driver.sys type= kernel sc.exe start Service (Service loads properly.) sc.exe stop Service
[SC] ControlService FAILED 1052: The requested control is not valid for this service.
The problem is my driver needs to create a non-PnP device node for communication. As I understand it PnP device drivers are loaded on demand by the system; my driver has no associated hardware and as such must be loaded manually. That part works fine if I create a device node - if I don’t sc.exe informs me there’s no devices associated with my driver and refuses to load it.
Unfortunately I don’t understand what you mean about the setup APIs. Where can I read about them? I do understand that if I were able to use the debugger the driver would be forcefully loaded, but I can’t use the debugger; I set up a VM to be a test machine but the provisioning tool can’t see it on the network even though every other tool I tested it with can. I asked about my (presumed) networking issues in a variety of places but never received an answer. NetBIOS should be working properly but isn’t, though the provisioning tool still fails when given a valid IP address.
Per my experience with my WDM version of the driver I have tried to use WdfObjectDelete to remove the device node I created, as failing to remove it seemed to make the driver unremovable. Calling WdfDeviceCreate in either EvtDriverUnload or the older WDM DriverUnload (populated via the DriverObject passed to DriverEntry) does not make the driver stoppable. What am I supposed to do?
If I can’t mix PnP and non-PnP driver frameworks then it looks like I will be unable to use your advice about using an HID miniport and will have to focus my efforts on the older WDM model. I may be unable to use your advice simply because I can’t get the debugger working and am unable to forcefully load the driver via that method.
Sorry, to clarify: the provisioning tool connects to the target machine but fails to provision it when given an IP. When given a hostname it fails to resolve it unless I set it up on the LAN’s DNS. I have followed the steps for provisioning a computer for driver deployment (i.e. running the executable located in the Windows Kits directory). The target computer has its own copy of VS2015 and the WDK if that matters.
Device node != device object. Device node is a representation of a pnp device stack in the system. It is made up of N device objects, usually from different drivers. Devcon install will create a virtual device node that will allow your pnp driver to load and attach to. Devcon uses setupapi to create the virtual device node. You can create a non pnp device in a pnp driver, you must do that in or after EvtDriverDeviceAdd. The struggles you are having have nothing to do with kmdf/wdf, you will have the same with wdm. These are the rules of the os, not the framework.
Forget provisioning from the wdk if it isn’t work for you. All it is doing is installing the driver package and calling devcon. You can do the same on your own with little effort and automate it with your own script if you want.
Bent from my phone
From: xxxxx@lists.osr.com on behalf of xxxxx@gmail.com Sent: Sunday, April 2, 2017 1:21:09 PM To: Windows System Software Devs Interest List Subject: RE:[ntdev] Unable to make WDF driver unloadable.
The problem is my driver needs to create a non-PnP device node for communication. As I understand it PnP device drivers are loaded on demand by the system; my driver has no associated hardware and as such must be loaded manually. That part works fine if I create a device node - if I don’t sc.exe informs me there’s no devices associated with my driver and refuses to load it.
Unfortunately I don’t understand what you mean about the setup APIs. Where can I read about them? I do understand that if I were able to use the debugger the driver would be forcefully loaded, but I can’t use the debugger; I set up a VM to be a test machine but the provisioning tool can’t see it on the network even though every other tool I tested it with can. I asked about my (presumed) networking issues in a variety of places but never received an answer. NetBIOS should be working properly but isn’t, though the provisioning tool still fails when given a valid IP address.
Per my experience with my WDM version of the driver I have tried to use WdfObjectDelete to remove the device node I created, as failing to remove it seemed to make the driver unremovable. Calling WdfDeviceCreate in either EvtDriverUnload or the older WDM DriverUnload (populated via the DriverObject passed to DriverEntry) does not make the driver stoppable. What am I supposed to do?
If I can’t mix PnP and non-PnP driver frameworks then it looks like I will be unable to use your advice about using an HID miniport and will have to focus my efforts on the older WDM model. I may be unable to use your advice simply because I can’t get the debugger working and am unable to forcefully load the driver via that method.
What you’ve said above might explain why I was experiencing crashes when trying to set up an HID miniport in a WDM driver.
I will try to use DevCon.exe to load my driver. Unfortunately that ties me to the WDK and Visual Studio 2015 which I was trying to avoid as I can’t install it on all computers I use. It seems like it is impossible to use the EWDK as a stand alone environment as it was intended to be used, if someone knowns otherwise and is willing to chime in I would appreciate it.
As silly as it sounds this is one of the things that may make me unable to use WDF and hidminiports - if the WDM model is the only model that works with tools not tied to the WDK and Visual Studio then I might have to use it. I will try to copy DevCon.exe and any dependencies I might need to another computer, however. Which brings me to a new set of questions:
Which SetupAPI functions should I be interested in? I tried looking on MSDN for information regarding the SetupAPIs and found things related to program and device [driver] installation. My goal would be to do what DevCon.exe does myself in case it’s not as portable as I hope it is. I might eventually get to the point I can duplicate most of what it does, in as far as I need it to test a PnP driver, by reading on my own, but if you can give me any pointers that would probably save me a lot of time.
The file to execute is actually an MSI package named
“WDK Test Target Setup x64-x64_en-us.msi” for the x64
version. It is located in the “Remote” directory of the
“Windows Kits” directory.
C:\Program Files (x86)\Windows Kits\10\Remote
You have to setup network sharing properly.
Try to setup and use a network share before provisioning.
If you do not use the Home edition of the OS, check that the Administrator
account is activated on the target and that a non empty password is set
for that account and then try to provision again with that account. Or
use another admin account with a non-empty password. These admin accounts
belongs to the target machine.
The provision software writes a log file that contains more detailed informations.
Thanks D. T. That was the executable I had been running. I also tried the x86 version, and more recently the versions from the host computer’s WDK installation. After running the .msi there is a corresponding entry in the programs list on the “Change or remove programs” control panel option.
I just created a network share and am now able to ping the test machines by their NetBIOS names. The Administrator account is now enabled on the test machine, but I’m not sure what you mean when you mention provisioning with an account. I’m never asked for login information for the machine I’m trying to connect to. Both machines are licensed versions of Windows 10 Pro.
Where is the log file? At the end of this message I’m going to attach what I’m receiving, but there might be something more useful. If I can’t connect to the machine at all the failure mode is a long delay and then a short “unable to connect” message.
Installing necessary components…
Failed operation: System.ArgumentException: None of the discovered or specified addresses match the socket address family.
Parameter name: context
at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult)
at System.Net.Sockets.TcpClient.EndConnect(IAsyncResult asyncResult)
at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization)
— End of stack trace from previous location where exception was thrown —
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.DriverKit.ExecManager.Transports.Network.WdkTcpClient.d__17.MoveNext() — End of stack trace from previous location where exception was thrown — at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.DriverKit.ExecManager.Transports.Network.WdkTcpClient.d__13.MoveNext() — End of stack trace from previous location where exception was thrown — at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.DriverKit.ExecManager.Transports.Network.NetworkTransportLayer.d__13`1.MoveNext() — End of stack trace from previous location where exception was thrown — at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.DriverKit.ExecManager.Communicators.RemoteCommunicator.d__17.MoveNext() — End of stack trace from previous location where exception was thrown — at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.DriverKit.Provisioning.ProvisioningServices.d__1.MoveNext() — End of stack trace from previous location where exception was thrown — at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.DriverKit.DriverServices.d__18.MoveNext() — End of stack trace from previous location where exception was thrown — at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.DriverKit.DriverTargetConfig.TargetProvisioner.d__6.MoveNext()
> The Administrator account is now enabled on the test machine, but I’m not sure what you mean when you mention provisioning with an account. I’m never asked for login information for the machine I’m trying to connect to. Both machines are licensed versions of Windows 10 Pro.
At first you provide the target machine’s IP address along with debug settings and then the provisioning software opens a session on the remote machine. At this stage a login window pops up. But it looks like the provisioning software cannot connect to the remote machine.
Are you using the NETBIOS name ? If yes, try to connect to the remote machine with its IP addeess.
>> The Administrator account is now enabled on the test machine, but I’m not sure what you mean when you mention provisioning with an account. I’m never asked for login information for the machine I’m trying to connect to. Both machines are licensed versions of Windows 10 Pro.
At first you provide the target machine???s IP address along with debug settings and then the provisioning software opens a session on the remote machine. At this stage a login window pops up. But it looks like the provisioning software cannot connect to the remote machine.
Are you using the NETBIOS name??? If yes, try to connect to the remote machine with its IP addeess.
That explanation makes sense. Yes, I had been using the NETBIOS name, as well as trying the IP. I just recently restarted the development machine to attempt provisioning again and it worked when I provided the IP. I cancelled the operation to try to NETBIOS name and it failed. Retrying using the IP then failed. After a reboot I was able to start the provisioning process again. Many of the steps failed but I can see a WDKTestUser and immediately after a reboot the machine was marked as available.
Some of the failures, like being unable to install redistributable packages, led me to believe the VS2015 installation on the test machine was getting in the way. I uninstalled VS2015 and almost every redistributable that was on the machine and reprovisioned it. All of the tasks completed properly. When I set the machine as a target for a blank project I’m able to enter the debugger properly.
Thanks for prompting me to try again - I have no idea what was wrong, but it basically decided to work this time.
While not extremely relevant the errors I received seem to be cause by all of the provisioning steps failing one after another. I’m not sure why they run - it appears it connects to the computer but something fails due to the use of either NETBIOS or IPv6. The NETBIOS names resolve to IPv6 addresses when running ping.
Well, despite the advice to use WDF (https://www.osronline.com/showthread.cfm?link=276223) I have found at least one project using WDM with HID miniports (https://github.com/jloehr/HID-Wiimote). Incorporating some code from that project (mainly passing through all IOCTLs that are not recognized) has prevented the driver from crashing the machine when loaded. Unfortunately, it suffers from the same problem as the WDF driver I originally asked about, namely that I can’t unload it despite it having an unload routine and the project that I was referencing expecting the driver to be unloadable as well.
I’d like to use the newer framework but between the issues getting the development environment installed, the inability to use the portable development environment (EWDK), and the comparative lack of reference source code I simply can’t. I’ve tried to refer to the documentation but haven’t made much progress in what I consider a reasonable timeframe.
I’m pretty sure most of the progress I have made has been from random guesses while staring at the documentation as opposed to guidance from the documentation, if that’s any indication of my feelings.
If you can’t get the ewdk working, use the normal wdk. The kit build has to work for wdm or wdf. I guess you can go back to the win7 wdk, but that seems like you are skirting the real issues
Bent from my phone
From: xxxxx@lists.osr.com on behalf of xxxxx@gmail.com Sent: Sunday, April 2, 2017 8:08:17 PM To: Windows System Software Devs Interest List Subject: RE:[ntdev] Unable to make WDF driver unloadable.
Well, despite the advice to use WDF (https://www.osronline.com/showthread.cfm?link=276223) I have found at least one project using WDM with HID miniports (https://github.com/jloehr/HID-Wiimote). Incorporating some code from that project (mainly passing through all IOCTLs that are not recognized) has prevented the driver from crashing the machine when loaded. Unfortunately, it suffers from the same problem as the WDF driver I originally asked about, namely that I can’t unload it despite it having an unload routine and the project that I was referencing expecting the driver to be unloadable as well.
I’d like to use the newer framework but between the issues getting the development environment installed, the inability to use the portable development environment (EWDK), and the comparative lack of reference source code I simply can’t. I’ve tried to refer to the documentation but haven’t made much progress in what I consider a reasonable timeframe.
I’m pretty sure most of the progress I have made has been from random guesses while staring at the documentation as opposed to guidance from the documentation, if that’s any indication of my feelings.
The EWDK works, in a sense, but I still need to put forth a lot of effort to test WDF drivers written with it. I’ll work a little more trying to get the WDF to work because it seems I have no choice.
In any case, I really appreciate the help. I might start having better luck when I get real hardware in but that still leaves my pet project of virtual device.
What do I do once I call HidRegisterMiniport? I think I need to implement some IOCTLs (https://msdn.microsoft.com/en-us/library/windows/hardware/ff539926(v=vs.85).aspx) but I see no way to do this in the context of WDF. Even the WDM example, the best that I could find, doesn’t really seem functional because so much code is missing.
I’ve tried to make sense of the documentation and failed.
You have VS2015 and WDK10 so just create a new KMDF driver project, say KMDFTestDriver. Select your configuration (Debug for instance). and platform (x64 for instance). Than, in the project properties, go to ‘Deploy’ and uncheck the check-box if it is checked so you can do the deployment manually for now.
Than build your project. If everything goes fine you should have a driver package with an INF file, a catalog file (.cat) and the driver’s binary (.sys). Copy the driver package’s directory to the target machine (by mean of a network share or a USB stick).
On the target machine, open a ‘Command Prompt’ with admin privileges. Change to the directory containing the driver package and then run the following command (assuming you have successfully provisionned the target, this should work):
Your driver should load and a new PNP enumerated device should be created and should be visible in the device manager.
Once you know how to add a PNP device to load your driver, you only need to learn how to disable this device to unload your driver, as Doron told you.This implies learning SetupAPI.
The wdf hid sample is fully functional and shows you how to create a WDFQUEUE to handle all of the io
Bent from my phone
From: xxxxx@lists.osr.com on behalf of xxxxx@gmail.com Sent: Monday, April 3, 2017 5:17:48 AM To: Windows System Software Devs Interest List Subject: RE:[ntdev] Unable to make WDF driver unloadable.
Dear Doran, or anyone else who knows,
What do I do once I call HidRegisterMiniport? I think I need to implement some IOCTLs (https://msdn.microsoft.com/en-us/library/windows/hardware/ff539926(v=vs.85).aspx) but I see no way to do this in the context of WDF. Even the WDM example, the best that I could find, doesn’t really seem functional because so much code is missing.
I’ve tried to make sense of the documentation and failed.