Keyboard low filter driver with WDK 26100 (Windows 11)

Hi there,
I'm a very newbie on driver development. I have keyboard low filter driver that attaching on kbdhid.sys and receiving its key event information, then decide send it out or bypass it. With previous WDK before version 26100 it's buildable well, but since I updated my WDK to 26100, the IDE telling me:

Service binary 'C:\Windows\System32\drivers\kbdhid.sys' should reference a CopyFiles destination file.

Tried several method I think I should use Include and Needs on my inx file, however, I do not know which file I should include. Just paste piece of inx here and appreciate any idea&opinion, thanks!

[kkblowfiltr.NT]
Include=keyboard.inf

[kkblowfiltr.NT.hw]
AddReg=kkblowfiltr_AddReg

[kkblowfiltr.NT.Services]
AddService=kkblowfiltr,0,kkblowfiltr_Service_Inst
AddService=kbdhid,0x00000002,kbdhid_Service_Inst ;flag 0x2 sets this as the service for the device

[kkblowfiltr_AddReg]
HKR,,"LowerFilters",0x00010008,"kkblowfiltr" ; FLG_ADDREG_TYPE_MULTI_SZ | FLG_ADDREG_APPEND

[kbdhid_Service_Inst]
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
StartType = 3 ; SERVICE_DEMAND_START
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
ServiceBinary = %12%\kbdhid.sys

[kkblowfiltr_Service_Inst]
DisplayName = %ServiceDesc%
ServiceType = 1
StartType = 3
ErrorControl = 1
ServiceBinary = %12%\kkblowfiltr.sys

[kkblowfiltr.NT.Wdf]
KmdfService=kkblowfiltr, kkblowfiltr_wdfsect

By the way I've tried specifying keyboard.inf, error is still the same

Right, because you're not just installing a filter driver. You're completely REPLACING the original driver for this device, and you can't specify a system driver for your service. If you can find a service entry in keyboard.inf, you can use Include/Needs to trigger it.

Are you trying to install a filter for a single device, or are you trying to install a class filter?

1 Like

Thanks Tim!
I think I'm trying install a filter for single device, my driver replaces the standard driver under keyboard class, and my driver receive all hid keyboard event from the supported keyboard.
My driver's function is likely Microsoft Kbfiler driver example, but mine is lowfilter so that we specify kbdhid.sys as service.
I can build it successfully with previous version WDK to extension for more keyboard support, however I need to support ARM64 at the same time. So 26100 is really necessary to me.

You should be able to use Include/Needs to invoke the keyboard.inf section that creates the main service, and just do your filter in your INF.

However, and this is my preferred method, it is quite possible to install a lower or upper filter on an existing device without using an INF at all. There are exactly three steps:

  1. Copy the sys file to \windows\system32\drivers
  2. Create a service for your driver
  3. Modify the LowerFilters registry entry for the device you want to filter

Steps 1 and 2 can be done with an elevated batch file, step 2 by using the "sc" command. Step 3 can be done with a simple application that uses the SetupDi APIs to find your device and modify the registry.

1 Like

Thank you Tim! If I try the three steps to lower filter my device,
how do I modify the .inf in my project? Can I just remove it?
And if I try these steps, is the install by pnputil still necessary?
By the way I'm considering your recommended upper filter method seriously :slight_smile:

(1) You wouldn't need the INF or the CAT. Just the SYS.
(2) pnputil only installs packages with an INF, so it's no longer needed. You would need to write your own custom utility to modify the registry using SetupDiEnumClassDevs and SetupDiSetDeviceRegistryProperty.

1 Like