Driver signing issues

Dear Experts,

I just started involving in Windows Driver Development, very freshly. And stuggling a lot to finish my task.

It would really the greatest help if somebody take interest to answer my below questions. My questions would be pretty big but all will be binary answers(yes or no).

  1. I am done developing an INF file with the windows default or native driver USBSER.SYS (CDC ACM MOdel) for my device.Its working fine too…
    My another aim is to create a Automatic Dial-up network connection as soon as the driver is installed as how the 3G Data Card/Modem’s(USB Modem) are working. A new Dial Up Connection will be created automatically whenever the USB modem is plugged in, with the driver installed in the PC.
    I heard that CDC ECM/CDC EEM models could be helpful, however there are no defualt or Native drivers for ECM/EEM models from microsoft.Am i wrong?
    In this case,Should the driver to be developed on our own to achieve my intention(creating a dial up connection)? Or Are Anyother drivers available?

  2. Please refer my inf file:

[Version]
DriverVer =04/22/2008,2.00
LayoutFile=Layout.inf
Signature=“$CHICAGO$”
Class=Ports
ClassGUID={4D36E945-E3h25-11CE-BFC1-08002BE10318}
Provider=%Mfg%
CatalogFile.NTx86=MyINFCat.cat (newly done by me to avoid the warnings )

[Manufacturer]
%Device1% = Device1,NTamd64
%Device2% = Device2,NTamd64
%Device3% = Device3,NTamd64
%Device4% = Device4,NTamd64

[DestinationDirs]
DefaultDestDir=12

;…
;-------------------------------------------------------- Windows XP/Vista/Win 7- 32 bit Architecture ---------------------------------------
;…

[Device1]
%MFG1% = MFG1,USB\VID_XXXX&PID_XXXX

[Device2]
%MFG2% = MFG2,USB\VID_XXXX&PID_XXXX

[Device3]
%MFG1% = MFG1,USB\VID_XXXX&PID_XXXX

[Device4]
%MFG2% = MFG2,USB\VID_XXXX&PID_XXXX

[MFG1.NT.Services]
AddService=usbser, 0x00000002, MFG1.SERVICEINST

[MFG1.SERVICEINST]
DisplayName=%MFG1%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG1.NT]
CopyFiles=CopyFileSection
AddReg=RegisterAddSection

[MFG2.NT.Services]
AddService=usbser, 0x00000002, MFG2.SERVICEINST

[MFG2.SERVICEINST]
DisplayName=%MFG2%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG2.NT]
CopyFiles=CopyFileSection
AddReg=RegisterAddSection

[CopyFileSection]
usbser.sys

[RegisterAddSection] ;ADPDTM USB serial emulation
HKR,DevLoader,*ntkern
HKR,NTMPDriver,usbser.sys
HKR,EnumPropPages32,“MsPorts.dll,SerialPortPropPageProvider”

;…
;-------------------------------------------------------- Windows XP/Vista/Win 7- 64 bit Architecture ---------------------------------------
;…

[Device1.NTamd64]
%MFG1% = MFG1.NTamd64,USB\VID_XXXX&PID_XXXX

[Device2.NTamd64]
%MFG2% = MFG2.NTamd64,USB\VID_XXXX&PID_XXXX

[Device3.NTamd64]
%MFG1% = MFG1.NTamd64,USB\VID_XXXX&PID_XXXX

[Device4.NTamd64]
%MFG2% = MFG2.NTamd64,USB\VID_XXXX&PID_XXXX

[MFG1.NTamd64.Services]
AddService=usbser, 0x00000002, MFG1.SERVICEINST.NTamd64

[MFG1.SERVICEINST.NTamd64]
DisplayName=%MFG1%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys
[MFG1.NTamd64]
CopyFiles=CopyFileSection.NTamd64
AddReg=RegisterAddSection.NTamd64

[MFG2.NTamd64.Services]
AddService=usbser, 0x00000002, MFG2.SERVICEINST.NTamd64

[MFG2.SERVICEINST.NTamd64]
DisplayName=%MFG2%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG2.NTamd64]
CopyFiles=CopyFileSection.NTamd64
AddReg=RegisterAddSection.NTamd64

[CopyFileSection.NTamd64]
usbser.sys

[RegisterAddSection.NTamd64] ;ADPDTM USB serial emulation
HKR,DevLoader,*ntkern
HKR,NTMPDriver,usbser.sys
HKR,EnumPropPages32,“MsPorts.dll,SerialPortPropPageProvider”

;…

[Strings]
Mfg = “MYOWN”
Device3 = “FROMUS”
Device4 = “FromUK”
Device1 = “From Europe”
Device2 = “FROMAus”
MFG1 = “USB MFG1 Range”
MFG2 = “USB MFG2 Range”

Is it Kerner Model driver inf? If so, why?

  1. Also , my driver installation should be a Software First Installaion or PNP installation. To do that, i am using DPInst.exe in my Installation Package. Its working fine but with windows signing warnings. I am intended to avoid these warnings. I am seriously struggling here with the following questions.
    3.1. My inf is working fine and i am using only the windows default driver(USBSER.sys) in the inf. In this case, is it required to sign the default sys file? Or Is it already Signed? Or Is signing not required?
    3.2.I have understood that Signing the driver binaries(SYS,DLL,…) and Signing the driver package(inf) are completely different. Also, the signing warning(Windows can’t verify the the publisher of the software) occurs only because of my unsigned inf and not because of the driver?Am i wrong?
    3.3 To avoid the above said warning, by assuming USESER.SYS doesn’t require any signing, i selfsigned or test signed my inf file in the following way as mentioned at http://www.itninja.com/question/guide-to-signing-unsigned-drivers.

creted .cat file using Inf2cat.exe

Inf2Cat.exe /driver:“”

# created certificate using makecert.exe
MakeCert.Exe -r -pe <path to .cer file you want generate> -n CN= -sv <path to .pvk file you want generate> -len 2048

3.4) As per the MS DDK Documentation, the test signing or Self Signing is done without PVK… Am i wrong in the last step?
But here i created the PVK also?

# Create Software Publisher’s Certificate (SPC) from our certificate
Cert2Spc.Exe <path to .cer file> <path to .spc file>

# Create a .pfx file
pvk2pfx.exe -pvk <path of .pvk file created earlier> -pi -spc “<path of .pfx to be stored>

# Sign the catalog file
signtool.exe sign /f “<path of .pfx file>” /p /t http://timestamp.comodoca.com/authenticode /v “”

# Installed the certificate in local machine
certmgr.exe /add “” /s /r localMachine root
certmgr.exe /add “” /s /r localMachine trustedPublishers

4. I am successuly created cert file and now, not getting any warnings during installation with DPInst.My critical question here is, can i distribute or publish this signed certificate that i created ?? i.e Can i install my self signed certificate in my clients machine ( is it legal to distribute my signed certificate for commercial use).
Please condsider that there won’t be any objection from my client side where i want to install the certificate.
Please clarify me. ( xxxxx@yahoo.com ). As for as my concerned, i am self signing only the INF file and not sys file, Here i need to really concern only about Microsoft policy on redistribution not to bother about my clients approval?

5.Seems that certmgr.exe is not distibutable and help me in providing the alternative tool or code to import the certificate?

With reference to your question posted in Stack overflow dated Sep 14, 2011, ( “Our device relies on a built-in windows driver (usbser.sys). Do we still need to go through WHQL testing or can we install in such a way that the user won’t see a warning about not passing Logo testing? I found http://support.microsoft.com/kb/837637 but it’s not clear to me if this will do what I want. Does it matter whether I use DPInst program or have my own program that calls DriverPackagePreinstall?”

I have similar doubts and thought you might be the right person to help me on it. kindly please reply to xxxxx@yahoo.com .

# I created a PnP driver installation package with DPInst, for USB device with native usbser.sys driver. I created my own .inf file. The inf is working fine in all versions of windows.

1) do i need to sign the usbser.sys though its a windows default or native driver?? Is already signed?

2) As per my understanding, can i sign my .inf by self-signing to avoid certification warnings??

I followed the following process to sign my inf ( please correct me if am wrong!! )

# creted .cat file using Inf2cat.exe
Inf2Cat.exe /driver:”"

# created certificate using makecert.exe
MakeCert.Exe -r -pe <path to .cer file you want generate> -n CN= -sv <path to .pvk file you want generate> -len 2048

3) As per the MS DDK Documentation, the test signing or Self Signing is done without PVK… Am i wrong in the last step?
Please refer the below link for the steps i followed:
http://www.itninja.com/question/guide-to-signing-unsigned-drivers

# Create Software Publisher’s Certificate (SPC) from our certificate
Cert2Spc.Exe <path to .cer file> <path to .spc file>

# Create a .pfx file
pvk2pfx.exe -pvk <path of .pvk file created earlier> -pi -spc "<path of .pfx to be stored>

# Sign the catalog file
signtool.exe sign /f “<path of .pfx file>” /p /t http://timestamp.comodoca.com/authenticode /v “”

# Installed the certificate in local machine
certmgr.exe /add “” /s /r localMachine root
certmgr.exe /add “” /s /r localMachine trustedPublishers

using above steps i creted the certificate and now while installing the package there is no " certificate warning ".

4) my doubt at this point is, can i distribute or publish this signed certificate?? i.e Can i install my self signed certificate in my clients machine ( is it legal to distribute my signed certificate for commercial use). Please condsider that there won’t be any objection from clients side where i want to install the certificate.
Please clarify me. ( xxxxx@yahoo.com ). As for as my concerned, i am self signing only the INF file and not sys file, so i am allowed to resdistribue? Kindly provide me the MS Links for reference.

Thanks in advance.

Karthi

Kindly ignore this post. I will create a new one. Sorry for the inconvenience.

Dear Experts,

I just started involving in Windows Driver Development, very freshly. And stuggling a lot to finish my task.

It would really the greatest help if somebody take interest to answer my below questions. My questions would be pretty big but all will be binary answers(yes or no).

  1. I am done developing an INF file with the windows default or native driver USBSER.SYS (CDC ACM MOdel) for my device.Its working fine too…
    My another aim is to create a Automatic Dial-up network connection as soon as the driver is installed as how the 3G Data Card/Modem’s(USB Modem) are working. A new Dial Up Connection will be created automatically whenever the USB modem is plugged in, with the driver installed in the PC.
    I heard that CDC ECM/CDC EEM models could be helpful, however there are no defualt or Native drivers for ECM/EEM models from microsoft.Am i wrong?
    In this case,Should the driver to be developed on our own to achieve my intention(creating a dial up connection)? Or Are Anyother drivers available?

  2. Please refer my inf file:

[Version]
DriverVer =04/22/2008,2.00
LayoutFile=Layout.inf
Signature=“$CHICAGO$”
Class=Ports
ClassGUID={4D36E945-E3h25-11CE-BFC1-08002BE10318}
Provider=%Mfg%
CatalogFile.NTx86=MyINFCat.cat (newly done by me to avoid the warnings )

[Manufacturer]
%Device1% = Device1,NTamd64
%Device2% = Device2,NTamd64
%Device3% = Device3,NTamd64
%Device4% = Device4,NTamd64

[DestinationDirs]
DefaultDestDir=12

;…
;-------------------------------------------------------- Windows XP/Vista/Win 7- 32 bit Architecture ---------------------------------------
;…

[Device1]
%MFG1% = MFG1,USB\VID_XXXX&PID_XXXX

[Device2]
%MFG2% = MFG2,USB\VID_XXXX&PID_XXXX

[Device3]
%MFG1% = MFG1,USB\VID_XXXX&PID_XXXX

[Device4]
%MFG2% = MFG2,USB\VID_XXXX&PID_XXXX

[MFG1.NT.Services]
AddService=usbser, 0x00000002, MFG1.SERVICEINST

[MFG1.SERVICEINST]
DisplayName=%MFG1%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG1.NT]
CopyFiles=CopyFileSection
AddReg=RegisterAddSection

[MFG2.NT.Services]
AddService=usbser, 0x00000002, MFG2.SERVICEINST

[MFG2.SERVICEINST]
DisplayName=%MFG2%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG2.NT]
CopyFiles=CopyFileSection
AddReg=RegisterAddSection

[CopyFileSection]
usbser.sys

[RegisterAddSection] ;ADPDTM USB serial emulation
HKR,DevLoader,*ntkern
HKR,NTMPDriver,usbser.sys
HKR,EnumPropPages32,“MsPorts.dll,SerialPortPropPageProvider”

;…
;-------------------------------------------------------- Windows XP/Vista/Win 7- 64 bit Architecture ---------------------------------------
;…

[Device1.NTamd64]
%MFG1% = MFG1.NTamd64,USB\VID_XXXX&PID_XXXX

[Device2.NTamd64]
%MFG2% = MFG2.NTamd64,USB\VID_XXXX&PID_XXXX

[Device3.NTamd64]
%MFG1% = MFG1.NTamd64,USB\VID_XXXX&PID_XXXX

[Device4.NTamd64]
%MFG2% = MFG2.NTamd64,USB\VID_XXXX&PID_XXXX

[MFG1.NTamd64.Services]
AddService=usbser, 0x00000002, MFG1.SERVICEINST.NTamd64

[MFG1.SERVICEINST.NTamd64]
DisplayName=%MFG1%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys
[MFG1.NTamd64]
CopyFiles=CopyFileSection.NTamd64
AddReg=RegisterAddSection.NTamd64

[MFG2.NTamd64.Services]
AddService=usbser, 0x00000002, MFG2.SERVICEINST.NTamd64

[MFG2.SERVICEINST.NTamd64]
DisplayName=%MFG2%
ServiceType= 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG2.NTamd64]
CopyFiles=CopyFileSection.NTamd64
AddReg=RegisterAddSection.NTamd64

[CopyFileSection.NTamd64]
usbser.sys

[RegisterAddSection.NTamd64] ;ADPDTM USB serial emulation
HKR,DevLoader,*ntkern
HKR,NTMPDriver,usbser.sys
HKR,EnumPropPages32,“MsPorts.dll,SerialPortPropPageProvider”

;…

[Strings]
Mfg = “MYOWN”
Device3 = “FROMUS”
Device4 = “FromUK”
Device1 = “From Europe”
Device2 = “FROMAus”
MFG1 = “USB MFG1 Range”
MFG2 = “USB MFG2 Range”

Is it Kerner Model driver inf? If so, why?

  1. Also , my driver installation should be a Software First Installaion or PNP installation. To do that, i am using DPInst.exe in my Installation Package. Its working fine but with windows signing warnings. I am intended to avoid these warnings. I am seriously struggling here with the following questions.
    3.1. My inf is working fine and i am using only the windows default driver(USBSER.sys) in the inf. In this case, is it required to sign the default sys file? Or Is it already Signed? Or Is signing not required?
    3.2.I have understood that Signing the driver binaries(SYS,DLL,…) and Signing the driver package(inf) are completely different. Also, the signing warning(Windows can’t verify the the publisher of the software) occurs only because of my unsigned inf and not because of the driver?Am i wrong?
    3.3 To avoid the above said warning, by assuming USESER.SYS doesn’t require any signing, i selfsigned or test signed my inf file in the following way as mentioned at http://www.itninja.com/question/guide-to-signing-unsigned-drivers.

creted .cat file using Inf2cat.exe

Inf2Cat.exe /driver:“”

# created certificate using makecert.exe
MakeCert.Exe -r -pe <path to .cer file you want generate> -n CN= -sv <path to .pvk file you want generate> -len 2048

3.4) As per the MS DDK Documentation, the test signing or Self Signing is done without PVK… Am i wrong in the last step?
But here i created the PVK also?

# Create Software Publisher’s Certificate (SPC) from our certificate
Cert2Spc.Exe <path to .cer file> <path to .spc file>

# Create a .pfx file
pvk2pfx.exe -pvk <path of .pvk file created earlier> -pi -spc "<path of .pfx to be stored>

# Sign the catalog file
signtool.exe sign /f “<path of .pfx file>” /p /t http://timestamp.comodoca.com/authenticode /v “”

# Installed the certificate in local machine
certmgr.exe /add “” /s /r localMachine root
certmgr.exe /add “” /s /r localMachine trustedPublishers

4. I am successuly created cert file and now, not getting any warnings during installation with DPInst.My critical question here is, can i distribute or publish this signed certificate that i created ?? i.e Can i install my self signed certificate in my clients machine ( is it legal to distribute my signed certificate for commercial use).
Please condsider that there won’t be any objection from my client side where i want to install the certificate.
Please clarify me. ( xxxxx@yahoo.com ). As for as my concerned, i am self signing only the INF file and not sys file, Here i need to really concern only about Microsoft policy on redistribution not to bother about my clients approval?

5.Seems that certmgr.exe is not distibutable and help me in providing the alternative tool or code to import the certificate?

> My another aim is to create a Automatic Dial-up network connection as soon as the driver is

installed as how the 3G Data Card/Modem’s(USB Modem) are working.

Can coinstaller help?


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com