Driver test signing on Win 2003.

Hi,

I have a bus driver (D1) which creates a PDO for a child device (it’s a virtual device) which is serviced by another driver (D2).

My problem is that although I have signed both drivers with a test certificate, and registered the certificate in the target machine’s certificate store (under root and trustedpublishers), the following happens:

  1. Windows says that the drivers are not signed during install.
  2. When creating D2 windows fails to start the device.

This is what I do to sign the drivers:

  1. Generate a certificate with makecert.
  2. Sign the drivers and cat file with signtool.
  3. Install the certificate on the target machine.

I have also set unsigned driver loading to Ignore.

My question is, is there something else I need to do, such as setting TESTSIGNING to ON on Vista.

Thanks,

Kevin.

Does w2k3 support test signing? I’m not sure of this, but if you haven’t read this document already, it’s a good place to start:

http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/KMCS_Walkthrough.doc

Sorry I don’t have better to offer,

mm

W2K3 does NOT support test signing in the same way as Vista+. There is no
way to use a self signed certificate or even an official Authenticode
certificate. The ONLY test signing it supports is WHQL test signing which
you get done by the WHQL web site (you have to have a WHQL account).

Jan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-404059-
xxxxx@lists.osr.com] On Behalf Of xxxxx@evitechnology.com
Sent: Thursday, March 04, 2010 1:30 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Driver test signing on Win 2003.

Does w2k3 support test signing? I’m not sure of this, but if you
haven’t read this document already, it’s a good place to start:

http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-
d599bac8184a/KMCS_Walkthrough.doc

Sorry I don’t have better to offer,

mm


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Thanks,

Since I have a WHQL account. I will try your suggestion.

Kevin.

You have to install the WHQL test root certificate too, and reboot. You can
tell the test root is installed by something like “for testing only” showing
up on the desktop.

Jan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-404078-
xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, March 04, 2010 2:05 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Driver test signing on Win 2003.

Thanks,

Since I have a WHQL account. I will try your suggestion.

Kevin.


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Are you sure you cannot add “Root Agency” to the cert store on pre-Vista?


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

“Jan Bottorff” wrote in message news:xxxxx@ntdev…
> W2K3 does NOT support test signing in the same way as Vista+. There is no
> way to use a self signed certificate or even an official Authenticode
> certificate. The ONLY test signing it supports is WHQL test signing which
> you get done by the WHQL web site (you have to have a WHQL account).
>
> Jan
>
>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com [mailto:bounce-404059-
>> xxxxx@lists.osr.com] On Behalf Of xxxxx@evitechnology.com
>> Sent: Thursday, March 04, 2010 1:30 PM
>> To: Windows System Software Devs Interest List
>> Subject: RE:[ntdev] Driver test signing on Win 2003.
>>
>> Does w2k3 support test signing? I’m not sure of this, but if you
>> haven’t read this document already, it’s a good place to start:
>>
>> http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-
>> d599bac8184a/KMCS_Walkthrough.doc
>>
>> Sorry I don’t have better to offer,
>>
>> mm
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
>

On W2K3, you can add new certificates to the root certificate stores, and it
has no effect. The driver signature checking code is hard coded to use only
specific WHQL roots.

There is an exception, if your device is in a custom device class, adding an
Authenticode certificate to the correct store improves things. For devices
in standard classes (there is an .inf that lists standard classes, which has
a Microsoft signed.cat, so can’t be changed by IHV’s).

I also tried to synthesize self-signed root certificates with appropriate
attribute bits (using the mono crypto libs as I remember, as it’s not
possible to set these using makecert), with no success. Even though there is
an attribute saying a certificate is essentially a WHQL root, it seems like
the code ignores these attributes and has hard coded knowledge of what the
valid roots are (this is understandable from a security viewpoint).

Another exception is during OS setup, signature checking is bypassed.

For unsigned drivers to install, you also must have an administrator logged
into the console (either physical or mstsc /console).

For a long time you were allowed to get unclassified WHQL signatures on
devices of any class, even ones that normally would be in standard classes,
but it seems like I recently read that was no longer true, or soon to be no
longer true. On Vista+ it’s not a big deal since you can just use an
Authenticode certificate, on W2K3 there is no such flexibility.

Jan

Are you sure you cannot add “Root Agency” to the cert store on pre-
Vista?

Adding to what Maxim is saying - I routinely add a self-signed test
certificate to both the (machine) Trusted Root and (machine) Trusted
Publisher stores. That certificate is used to (self) test-sign driver
packages (in this case, Net and NetService class) and can install them
silently on XP and XP64 (which AFAIK, should behave like 2K3). Am I just
lucky? Maybe so.

Regards,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Friday, March 05, 2010 9:27 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Driver test signing on Win 2003.

Are you sure you cannot add “Root Agency” to the cert store on
pre-Vista?


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

“Jan Bottorff” wrote in message
news:xxxxx@ntdev…
> W2K3 does NOT support test signing in the same way as Vista+. There is no
> way to use a self signed certificate or even an official Authenticode
> certificate. The ONLY test signing it supports is WHQL test signing which
> you get done by the WHQL web site (you have to have a WHQL account).
>
> Jan
>
>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com [mailto:bounce-404059-
>> xxxxx@lists.osr.com] On Behalf Of xxxxx@evitechnology.com
>> Sent: Thursday, March 04, 2010 1:30 PM
>> To: Windows System Software Devs Interest List
>> Subject: RE:[ntdev] Driver test signing on Win 2003.
>>
>> Does w2k3 support test signing? I’m not sure of this, but if you
>> haven’t read this document already, it’s a good place to start:
>>
>> http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-
>> d599bac8184a/KMCS_Walkthrough.doc
>>
>> Sorry I don’t have better to offer,
>>
>> mm
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
>


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Refering to David R. Cattley reply. I tested self-signed test certificates with XP and they work fine. It’s with the servers that things seem to get hairy.

Server W2K3 was the peak of signing inflexibility. I’d suggest you pursue
WHQL unclassified (or real) signatures if you can.

Jan

Refering to David R. Cattley reply. I tested self-signed test
certificates with XP and they work fine. It’s with the servers that
things seem to get hairy.

I do sign my drivers for release. The problem is that I want to test sign them for QA . :slight_smile:

Admittedly I cannot point to a case where I did that with the Server 2003
SKU so perhaps the fact that I used the Workstation (XP64) SKU obscured my
perception.

Cheers,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Friday, March 05, 2010 12:14 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Driver test signing on Win 2003.

Refering to David R. Cattley reply. I tested self-signed test certificates
with XP and they work fine. It’s with the servers that things seem to get
hairy.


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

The only solution I know that gives the exact behavior of production WHQL
signed drivers on W2K3 is to use WHQL test signing. I worked on a virtual
I/O product where nic and storage devices were dynamically created on a
virtual bus. Part of the QA was to dynamically add and remove devices many
times from scripted tests. Scripted tests included scenarios like migrating
workloads along with their virtual I/O devices between physical servers, so
having to manually click on a found new hardware dialog on the destination
machine was exceedingly painful. These migration tests might runs thousands
of cycles (or across a dozen QA machines at once) with dozens of virtual
devices, so that would be a lot of clicking ok on a dialog if done manually.

An ugly workaround that helped QA before was: you can have a class
coinstaller for your device class that changes the ranking field of the
device under test. If you look at the setup API’s, there is a structure that
contains the driver ranking, and I believe the high bit means unsigned. It
is possible to update this ranking field to indicate the driver is signed,
which has the effect of bypassing the found new hardware dialog (during
client side install only, server side install will always fail due to no
WHQL signature). This ranking hack was reported to Microsoft as a security
bug a while ago, so may no longer work (their analysis was it was low risk
anyway). This also does not bypass the requirement to have an administrator
logged into the console. This also alters the actual behavior from what a
real system would do as real signed drivers will successful do server side
installs, so is a limited solution for later QA stages.

Another QA workaround I’ve see is to write an application that periodically
scans for (like every 10 seconds) the found new hardware dialog box (by
reading back the window title of every window), and if it finds it, sends
the correct events to the dialog controls to satisfy it. Using one of the
window spy utilities will help you figure out the child control id’s to send
messages to.

I believe the dtm test client can install unsigned drivers on W2K3, so some
reverse engineering might figure out the voodoo it uses, although it might
require using some component that’s part of the dtm client. You could use
dtm to run custom test scripts, and just get the benefit of it’s capability.
Dtm I believe was expected to be used to run IHV tests in addition to WHQL
tests, although most places doing automated QA that I’ve seen have their own
QA automation environment.

Another strategy might be to write a scripted interface to the WHQL website
than can submit a new build for test signing automatically. If you don’t do
that many builds for QA, just manually getting the WHQL test signature is
also an option. WHQL test signatures I believe are the only QA solution I’ve
seen that can successfully do server side installs with no logged in
administrator.

Some of these workaround may be days (or more) of programming, so you would
need to balance the pain of manually getting WHQL test signatures against
the cost of some more automated solution. You can also get people a little
less expensive than kernel developers to walk new QA builds though the WHQL
test signing workflow. There isn’t an easy fix if you really want to do
extensive QA on W2K3.

Jan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-404165-
xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Friday, March 05, 2010 9:54 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Driver test signing on Win 2003.

I do sign my drivers for release. The problem is that I want to test
sign them for QA . :slight_smile:


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer