Correct way to update a NT-style driver

NTDEV
1

Hello,

Assume that I want to update a NT-style (Non plug and play) driver.
What is the correct way to do it?
Can I simply replace the sys file? (Of course I will restart the computer after that).
I could not find information about it in this forum nor in the WDK documentation.

More information:
The driver is installed as follows:

  1. We copy the sys file to the system32\drivers directory.
  2. We run the “sc.exe create …” command.
    By the way, is this a good installation method?

I ask this question because I’m afraid that Windows might detect that a system file is damaged and recover the older file. Does Windows has such a feature at all?
I work on Windows XP through Windows 7.

I am also curious whether or not NT-style drivers are supported on Windows 8.
Will they be supported on newer versions of Windows?

Thank you,
Itai

2

Legacy drivers load, whether they are still supported depends on what the driver is doing. If using HW resources, there is no definitive answer. Copying and rebooting is fine to update, the os doesn’t care because you are not updating a windows owned binary

d

Bent from my phone

From: xxxxx@rafael.co.ilmailto:xxxxx
Sent: ?3/?17/?2013 5:02 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] Correct way to update a NT-style driver

Hello,

Assume that I want to update a NT-style (Non plug and play) driver.
What is the correct way to do it?
Can I simply replace the sys file? (Of course I will restart the computer after that).
I could not find information about it in this forum nor in the WDK documentation.

More information:
The driver is installed as follows:
1) We copy the sys file to the system32\drivers directory.
2) We run the “sc.exe create …” command.
By the way, is this a good installation method?

I ask this question because I’m afraid that Windows might detect that a system file is damaged and recover the older file. Does Windows has such a feature at all?
I work on Windows XP through Windows 7.

I am also curious whether or not NT-style drivers are supported on Windows 8.
Will they be supported on newer versions of Windows?

Thank you,
Itai

—
NTDEV is sponsored by OSR

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

3

Doron, thank you for the answer.
It is a software-only driver, which does not control any hardware.
Will such a legacy driver work on Windows 8? What about future versions of Windows?
-Itai

4

Yes, a legacy-style (NT V4 type) Software Only driver will work on Windows 8. These drivers are still *very* widely used. In fact, we currently teach a seminar specifically describing how to write such drivers.

In fact… if you think about it… Windows file systems architecturally resemble these drivers more than any other type of driver on Windows.

It would be architecturally difficult in the extreme to break NT V4 style (legacy) software-only drivers without changing many of the fundamentals of the Windows I/O subsystem. Therefore, there is little to no possibility that such a driver would stop working on Windows versions in the foreseeable future.

Peter
OSR

5

another example is the kmdf driver, wdf0100.sys, which is a legacy nt4 style driver.

d

Bent from my phone

From: xxxxx@osr.commailto:xxxxx
Sent: ?3/?17/?2013 1:29 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Correct way to update a NT-style driver



Yes, a legacy-style (NT V4 type) Software Only driver will work on Windows 8. These drivers are still very widely used. In fact, we currently teach a seminar specifically describing how to write such drivers.

In fact… if you think about it… Windows file systems architecturally resemble these drivers more than any other type of driver on Windows.

It would be architecturally difficult in the extreme to break NT V4 style (legacy) software-only drivers without changing many of the fundamentals of the Windows I/O subsystem. Therefore, there is little to no possibility that such a driver would stop working on Windows versions in the foreseeable future.

Peter
OSR

—
NTDEV is sponsored by OSR

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

6

xxxxx@rafael.co.il wrote:

Assume that I want to update a NT-style (Non plug and play) driver.
What is the correct way to do it?
Can I simply replace the sys file? (Of course I will restart the computer after that).
I could not find information about it in this forum nor in the WDK documentation.

As long as you can unload the driver, you don’t even have to restart.
You can stop the service, copy in the new binary, and then restart the
service. If there are long-running applications that have handles open,
that won’t work.

More information:
The driver is installed as follows:

  1. We copy the sys file to the system32\drivers directory.
  2. We run the “sc.exe create …” command.
    By the way, is this a good installation method?

For a legacy driver, this is fine.

I ask this question because I’m afraid that Windows might detect that a system file is damaged and recover the older file. Does Windows has such a feature at all?

You are not a system file.

I am also curious whether or not NT-style drivers are supported on Windows 8.
Will they be supported on newer versions of Windows?

I can tell you this: in the more than 20 year history of the NT
operating systems, no driver technology has ever been removed.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

7

On Mon, Mar 18, 2013 at 9:32 AM, Tim Roberts wrote:

> I can tell you this: in the more than 20 year history of the NT
> operating systems, no driver technology has ever been removed.

I once needed to write a lot of VDDs (not VxD on 98) for NT3.5x and NT4 to
support 16-bit DOS programs access to the HW that I designed and soldered.
Doing complete sw and hw design was very interesting back then but I don’t
remember the last time I need to mess with NTVDM. I assume they are removed
technologies.

Calvin

8

Hmmmm… Is that really true?

I don’t think you can actually write NDIS Full MAC drivers anymore, can you?

And various video driver technologies have come and gone a few times, too.

Peter
OSR

9

xxxxx@osr.com wrote:

Hmmmm… Is that really true?

I don’t think you can actually write NDIS Full MAC drivers anymore, can you?

And various video driver technologies have come and gone a few times, too.

You guys really know how to kill a buzz.

GDI drivers migrated from user-mode to kernel-mode in NT 4. That is
true, although that NT 4 driver still works today. I’m not aware of any
other video technology that has come and gone. Even a Video For Windows
driver still works today.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

10

I didn’t KNOW that.

Having scoured my brain to find an example of a single driver technology that no longer works, I certainly agree with the essence of your point: Microsoft is loathe to break drivers that are in the field. It *almost* never happens.

Peter
OSR

11

>I once needed to write a lot of VDDs (not VxD on 98) for NT3.5x and NT4 to support 16-bit DOS

programs access to the HW that I designed and soldered.

Great way to write hardware emulators.

need to mess with NTVDM. I assume they are removed technologies.

Win64 never supported NTVDM.

Isn’t it still here in 32bit modern Windows?

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

12

> It *almost* never happens.

Other than the display/GDI gyrations already noted I think you may be right
in that the only others are NDIS3.x full MAC driver support, and STREAMS
based network drivers (gosh, I can’t remember even seeing one).

That 'ol NT sure has some legs.

Cheers,
Dave Cattley

13

>“Tim Roberts” wrote in message news:xxxxx@ntdev…

I can tell you this: in the more than 20 year history of the NT operating
systems, no driver technology has ever been removed.

What about Firewall hook drivers ? And IpHook drivers ? And older NDIS
drivers ? They stopped working, didn’t they ?

His driver may also not work if it uses any of the undocumented techniques
or hacks that were acceptable at the time but not anymore. Or if it runs
into one of the many new security features that prohibits one of the things
it does.

I think it’s not very reasonable to tell him to expect his driver will work
without knowing what it does and how it’s written.

//Daniel

14

> What about Firewall hook drivers ? And IpHook drivers ? Oh yeah, them too. I think the MSFT plan was to make believe those did not exist (e.g. Ignore that API behind the curtain, move along folks, nothing to see here …) and that plan almost worked! But yeah, them too. They were on the cutting room floor pretty quickly. And you can add to that list some other ‘features’ that crept in & out of the network area just as quickly (Fast Forward Path or some such). Cheers,Dave Cattley

15

> -----Original Message-----

From: xxxxx@osr.com

Having scoured my brain to find an example of a single driver
technology that no longer works, I certainly agree with the essence of
your point: Microsoft is loathe to break drivers that are in the
field.
It *almost* never happens.

Peter
OSR

One glaring exception - legacy-style PCI drivers do not work from Vista
and up.

Best regards,
Alex Krol

16

Actually, they may or may not work depending on a lot of factors on XP
and Server 2003.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Alexander Krol” wrote in message
news:xxxxx@ntdev:

> > -----Original Message-----
> > From: xxxxx@osr.com
> >
> > Having scoured my brain to find an example of a single driver
> > technology that no longer works, I certainly agree with the essence of
> > your point: Microsoft is loathe to break drivers that are in the
> field.
> > It almost never happens.
> >
> > Peter
> > OSR
>
> One glaring exception - legacy-style PCI drivers do not work from Vista
> and up.
>
> Best regards,
> Alex Krol

17

Good point. But, SOMEtimes they do.

However… I agree, the model is deprecated to the point where there is no attempt to ensure that this type of driver works anymore.

Pretty amazing, isn’t it? In more than 30 years of Windows history we can only name a few things in driver-land that no longer work?

Peter
OSR

18

xxxxx@osr.com wrote:

Pretty amazing, isn’t it? In more than 30 years of Windows history we can only name a few things in driver-land that no longer work?

Yes. The BINARIES for my video capture drivers work correctly on
everything from Windows 98SE through Windows 8. That’s astonishing.
Compare that to the Mac, where both the APIs and the formats change
regularly, or to Linux, where a kernel binary works with exactly one
release, and even the source code often has to be revised from release
to release.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

19

And they kill power management on the machine from w2k up.

“Don Burn” wrote in message news:xxxxx@ntdev…
> Actually, they may or may not work depending on a lot of factors on XP
> and Server 2003.
>
>
> Don Burn
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
>
> “Alexander Krol” wrote in message
> news:xxxxx@ntdev:
>
>> > -----Original Message-----
>> > From: xxxxx@osr.com
>> >
>> > Having scoured my brain to find an example of a single driver
>> > technology that no longer works, I certainly agree with the essence of
>> > your point: Microsoft is loathe to break drivers that are in the
>> field.
>> > It almost never happens.
>> >
>> > Peter
>> > OSR
>>
>> One glaring exception - legacy-style PCI drivers do not work from Vista
>> and up.
>>
>> Best regards,
>> Alex Krol
>
>

20

By the way, I didn’t even put HalGetBusData and HalSetBusData into the virtual PCI implementation in Hyper-V guest VMs. So while legacy-style PCI drivers SOMEtimes do work, they never work in a guest VM. That doesn’t matter much today, when all such drivers are NDIS miniports for SR-IOV virtual functions. It would matter more if we ever used that technology for something else.

Just saying…

  • Jake Oshins
    Windows Kernel Team

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@osr.com
Sent: Tuesday, March 19, 2013 5:12 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Correct way to update a NT-style driver

Good point. But, SOMEtimes they do.

However… I agree, the model is deprecated to the point where there is no attempt to ensure that this type of driver works anymore.

Pretty amazing, isn’t it? In more than 30 years of Windows history we can only name a few things in driver-land that no longer work?

Peter
OSR

NTDEV is sponsored by OSR

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer