Load Windows 8 driver on Windows 7 by ZwLoadDriver

NTDEV
21

Thanks for detail explanation.
I’m aware of things to do for single binary on multiple OSes such as dynamic linking.

The problem I’m facing is ZwLoadDriver() fails to load driver, so DriverEntry is not even called.
Of course, error code of 0xC00000263 tells that no DriverEntry found.

I’m looking for the reason of failure and whether I’m doing possible work.

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of m [xxxxx@hotmail.com]
Sent: Wednesday, August 29, 2012 6:26 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

If use separate binaries, then you should alter the code paths by using
pragmas not if statements. That way, the Windows 7 compatible code is not
even compiled into the Windows 8 binary and vice versa.

If you use a single binary, then you need to ensure that you don’t
statically link against any API (DDI) that is not available on your minimum
target OS (Windows 7 in this case). Then user MmGetSystemRoutineAddress
(the equivalent of GetProcAddress in UM) to get function pointers to the
newer APIs you want and can call them if present. Note that it is usually
better practice to check for the presence of the APIs themselves rather than
a specific OS version when deciding which logic to follow as APIs can be
(and in some cases have been) back ported to older OSes via service packs,
or removed from later OSes. The ones you statically link against will be
verified by the loader, but when you dynamically link, you should make sure
that you get valid function pointers for everything you need to call in a
certain path

“Woojung Huh” wrote in message news:xxxxx@ntdev…

Thanks Don & Phil.

First of all, I’m not using Win8 feature on Win7. :slight_smile:

Driver goes different code path and uses different OS defined structure per
Window version.
For instance, Windows 8 WDK defined structure has more members in same
structure than Windows 7.
(I’m afraid that I may not be able to write details. Sorry about it.)
Driver will determine version of OS by API RtlIsNtDdiVersionAvailable() and
go different path.

My idea is building driver with Windows 8 WDK based on MSDN
(http://msdn.microsoft.com/en-us/library/windows/hardware/jj572863(v=vs.85).aspx
)
And, let it work on all version of OSes. Otherwise, I need to build two
separate drivers, Win7 and Win8.

As I wrote in 1st email, Boot Device driver built with Windows 8 WDK with
instruction in above link is working on Windows 7.
(It wasn’t working without changing link library.)
So, I was hopeful until getting error at ZwLoadDriver() to load another
kernel mode driver which is built with Windows 8 WDK with modification of
link library.

But, look like it is not possible at all.

Woojung

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-511972-
xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Wednesday, August 29, 2012 1:43 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
ZwLoadDriver

You can play games with MmGetSystemRoutineAddress but as Phil pointed
out you can’t use a Win8 only feature in Win7. Why would you have ever
thought you could?

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Woojung Huh” wrote in message
> news:xxxxx@ntdev:
>
> > Thanks Don.
> >
> > OK. I missed this part. Sorry. :frowning:
> > I need Win8 specific features and it should be compiled with Win8 target
> > to
> work on Windows 8.
> > That makes me build two (Win7 & Win8) drivers and want to avoid it.
> >
> > It doesn’t look there is silver bullet.
> >
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com [mailto:bounce-511965-
> > > xxxxx@lists.osr.com] On Behalf Of Don Burn
> > > Sent: Wednesday, August 29, 2012 1:18 PM
> > > To: Windows System Software Devs Interest List
> > > Subject: RE:[ntdev] Re:Load Windows 8 driver on Windows 7 by
> > > ZwLoadDriver
> > >
> > > Build the driver for Win7 and it should work on Win8.
> > >
> > >
> > > Don Burn
> > > Windows Filesystem and Driver Consulting
> > > Website: http://www.windrvr.com
> > > Blog: http://msmvps.com/blogs/WinDrvr
> > >
> > >
> > >
> > >
> > > “Woojung Huh” wrote in message
> > > news:xxxxx@ntdev:
> > >
> > > > Thanks for all you replies.
> > > >
> > > > Here are working scenarios.
> > > > 1. Driver built with Win7 DDK works well with ZwLoadDriver() on
> Windows 7
> > > > 2. Driver built with Win7 target on VS + Win8 WDK works well with
> > > ZwLoadDriver() on Windows 7
> > > > 3. Driver built with Win8 target on VS + Win8 WDK works well with
> > > ZwLoadDriver() on Windows 8
> > > >
> > > > Now I’m trying to have a single binary to work on all OSes.
> > > >
> > > > And, by MSDN link I posted in original email, Changing to
> > > BufferOverFlowK.lib is option to run a driver on all version of
> > > Windows.
> > > > Am I missing something?
> > > >
> > > > Thanks again.
> > > > Woojung
> > > >
> > > > > -----Original Message-----
> > > > > From: xxxxx@lists.osr.com [mailto:bounce-511961-
> > > > > xxxxx@lists.osr.com] On Behalf Of Doron Holan
> > > > > Sent: Wednesday, August 29, 2012 12:58 PM
> > > > > To: Windows System Software Devs Interest List
> > > > > Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> > > > > ZwLoadDriver
> > > > >
> > > > >
> > > > > What Os target did you build for? If you built for w8, it won’t
> > > > > load by
> > > default
> > > > > downlevel because you are linking against
> > > > > bufferoverflowfastfail.lib
> > > which
> > > > > requires win8 loader support for the security cookie to initialize
> > > > > d
> > > > >
> > > > >
> > > > > ________________________________________
> > > > > From: xxxxx@lists.osr.com [bounce-511958-
> > > > > xxxxx@lists.osr.com] on behalf of Don Burn [xxxxx@windrvr.com]
> > > > > Sent: Wednesday, August 29, 2012 9:39 AM
> > > > > To: Windows System Software Devs Interest List
> > > > > Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> > > ZwLoadDriver
> > > > >
> > > > > First, these drivers are built for Windows 7 right? Second is one
> > > > > of
> > > > > these a KMDF driver? In general ZwLoadDriver is not the way to
> > > > > load
> > > > > drivers (assuming you are calling it).
> > > > >
> > > > >
> > > > > Don Burn
> > > > > Windows Filesystem and Driver Consulting
> > > > > Website: http://www.windrvr.com
> > > > > Blog: http://msmvps.com/blogs/WinDrvr
> > > > >
> > > > >
> > > > > “Woojung Huh” wrote in message
> > > > > news:xxxxx@ntdev:
> > > > >
> > > > > > All,
> > > > > >
> > > > > > By MSDN (http://msdn.microsoft.com/en-
> > > > > us/library/windows/hardware/jj572863(v=vs.85).aspx), VS with Win8
> > > WDK
> > > > > can build the driver for all OSes.
> > > > > > With the guideline, I can load Win8-WDK-build BootDevice driver
> > > > > > on
> > > > > Windows 7.
> > > > > >
> > > > > > However, Windows7 fails to load another Win8-WDK-build kernel
> mode
> > > > > driver by ZwLoadDriver() API with error of 0xC0000263 (Driver
> > > > > Entry
> Point
> > > Not
> > > > > Found)
> > > > > > Error message tells there is version mismatch.
> > > > > >
> > > > > > I’d like to confirm that it is NOT possible or any mistake.
> > > > > >
> > > > > > Thanks in advance.
> > > > > > Woojung
> > > > >
> > > > >
> > > > > —
> > > > > NTDEV is sponsored by OSR
> > > > >
> > > > > For our schedule of WDF, WDM, debugging and other seminars visit:
> > > > > http://www.osr.com/seminars
> > > > >
> > > > > To unsubscribe, visit the List Server section of OSR Online at
> > > > > http://www.osronline.com/page.cfm?name=ListServer
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > NTDEV is sponsored by OSR
> > > > >
> > > > > For our schedule of WDF, WDM, debugging and other seminars visit:
> > > > > http://www.osr.com/seminars
> > > > >
> > > > > To unsubscribe, visit the List Server section of OSR Online at
> > > > > http://www.osronline.com/page.cfm?name=ListServer
> > >
> > >
> > > —
> > > NTDEV is sponsored by OSR
> > >
> > > For our schedule of WDF, WDM, debugging and other seminars visit:
> > > http://www.osr.com/seminars
> > >
> > > To unsubscribe, visit the List Server section of OSR Online at
> > > http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

22

This does not (today) cause a failure to load an image in kernel mode.

One cannot, however, map an image section to run in user mode if the subsystem version is greater than the OS version.

It is possible to target a driver for a downlevel version of the OS and still use uplevel features, but you have to exercise caution when doing so as the build system cannot add in build breaks in this case if you try to take a hardcoded dependency on features not available on earlier OS versions. The way to think about this is that the build environment, by default, semantically treats the target OS version as the *minimum* OS version that you will want to support (which makes sense when you are using, for example, new driver model capabilities not present on older releases). All of the build environment compile and link time safeguards are really set up to work like this.

All of this can trip you up if you aren’t careful when telling the build system that you’re going to play with fire and take matters into your own hands with targeting an OS version that isn’t really the minimum OS version that your driver needs to run on. For example:

This is probably what has happened to the OP here.

  • You can inadvertently pass parameters to OS functions in a way that wasn’t supported downlevel, which might result in runtime conditions that you don’t expect - the headers will not cause you to get a build break at compile time if the minimum OS version is not your target OS version

Usually, you have to carefully check the documentation to ensure that you don’t accidentally do this, as there is no load time check to save you (read: fail to load your driver) if you make a mistake. Some features that become available only when a driver runs on more recent OS versions have compile time options to make this easier to manage with respect to older OS version support, like the POOL_NX_OPTIN support for porting drivers to use the more secure NonPagedPoolNx (http://msdn.microsoft.com/en-us/library/windows/hardware/hh920393(v=vs.85).aspx ).

  • Code added to your binary by the build environment might assume that it is running on what you have told the build system is the “target” OS version. One example for Windows 8, that Doron alluded to several times in this thread, is that you’ll have to change the /GS security cookie stub library linked in to your driver to the downlevel-aware flavor if you plan to run on old OS’s but still tell the build system that you are going to “target” Windows 8 - or you’d get a bugcheck 0x139 / type 6 when starting the driver downlevel < http://msdn.microsoft.com/en-us/library/windows/hardware/jj569891(v=vs.85).aspx > ).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Wednesday, August 29, 2012 2:55 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

It might be a usermode binary. IIRC Skywing once wrote about this.
Usually I can run drivers built for Win7 target on Vista (SP1), but not usermode stuff.
– pa

On 30-Aug-2012 00:00, Vodicka, Michal wrote:

Strange. I’m almost sure that I had a problem with driver (not boot one) loading just because of this. But maybe I don’t remember it correctly and it was a user mode binary…

Michal

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-511990-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Wednesday, August 29, 2012 10:31 PM
> To: Windows System Software Devs Interest List
> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> I had the same misconception until recently. Mm in kernel mode
> doesn’t look at the subsystem version in the PE header, so it doesn’t
> matter what the value is. You can build a driver with win8 as the os
> target and load it on win7 if everything aligns (note that you must
> probably do this aligning yourself). This is unlike user mode where
> the user mode loader will look at the subsystem version and fail
> versions that are newer than the OS
>
> -----Original Message-----

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

23

Wow! this thread is getting longer than I expected.
I might mislabel the thread title. :frowning:

Going back to the first post.
http://msdn.microsoft.com/en-us/library/windows/hardware/jj572863(v=vs.85).aspx mentions that
“If you want your kernel-mode driver to run on multiple versions of Windows and dynamically determine the features that are available to the driver, build the driver using the build configuration for the most recent version of the operating system…” and “you are targeting Windows 8 but want to run on earlier versions of Windows, you also need to override the linker $(KernelBufferOverflowLib) option because Windows 8 links with BufferOverflowFastFailK.lib, which is not available in earlier Windows versions. Windows 7 and Vista must link with BufferOverflowK.lib instead.”
Yes, without linking to BufferOverflowK.lib, I ended up to have BugCheck as you describe.

Because MSDN shows me a hope to make a single device driver for Win7 & Win8,
I built two drivers with BufferOverflowK.lib, one is for BootDevice and the other is device driver loaded by ZwLoadDriver() from other driver.
BootDevice is loaded correctly (which got BugCheck before) but ZwLoadDriver() failed.

I understand all possible problem may come even if ZwLoadDriver() succeeded.
However, I have no clear explanation that why ZwLoadDriver() failed with error of 0xC00000263 (Driver Entry Not Found)

Thanks,
Woojung

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of Skywing [xxxxx@valhallalegends.com]
Sent: Wednesday, August 29, 2012 10:08 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

This does not (today) cause a failure to load an image in kernel mode.

One cannot, however, map an image section to run in user mode if the subsystem version is greater than the OS version.

It is possible to target a driver for a downlevel version of the OS and still use uplevel features, but you have to exercise caution when doing so as the build system cannot add in build breaks in this case if you try to take a hardcoded dependency on features not available on earlier OS versions. The way to think about this is that the build environment, by default, semantically treats the target OS version as the *minimum* OS version that you will want to support (which makes sense when you are using, for example, new driver model capabilities not present on older releases). All of the build environment compile and link time safeguards are really set up to work like this.

All of this can trip you up if you aren’t careful when telling the build system that you’re going to play with fire and take matters into your own hands with targeting an OS version that isn’t really the minimum OS version that your driver needs to run on. For example:

This is probably what has happened to the OP here.

  • You can inadvertently pass parameters to OS functions in a way that wasn’t supported downlevel, which might result in runtime conditions that you don’t expect - the headers will not cause you to get a build break at compile time if the minimum OS version is not your target OS version

Usually, you have to carefully check the documentation to ensure that you don’t accidentally do this, as there is no load time check to save you (read: fail to load your driver) if you make a mistake. Some features that become available only when a driver runs on more recent OS versions have compile time options to make this easier to manage with respect to older OS version support, like the POOL_NX_OPTIN support for porting drivers to use the more secure NonPagedPoolNx (http://msdn.microsoft.com/en-us/library/windows/hardware/hh920393(v=vs.85).aspx ).

  • Code added to your binary by the build environment might assume that it is running on what you have told the build system is the “target” OS version. One example for Windows 8, that Doron alluded to several times in this thread, is that you’ll have to change the /GS security cookie stub library linked in to your driver to the downlevel-aware flavor if you plan to run on old OS’s but still tell the build system that you are going to “target” Windows 8 - or you’d get a bugcheck 0x139 / type 6 when starting the driver downlevel < http://msdn.microsoft.com/en-us/library/windows/hardware/jj569891(v=vs.85).aspx > ).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Wednesday, August 29, 2012 2:55 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

It might be a usermode binary. IIRC Skywing once wrote about this.
Usually I can run drivers built for Win7 target on Vista (SP1), but not usermode stuff.
– pa

On 30-Aug-2012 00:00, Vodicka, Michal wrote:

Strange. I’m almost sure that I had a problem with driver (not boot one) loading just because of this. But maybe I don’t remember it correctly and it was a user mode binary…

Michal

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-511990-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Wednesday, August 29, 2012 10:31 PM
> To: Windows System Software Devs Interest List
> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> I had the same misconception until recently. Mm in kernel mode
> doesn’t look at the subsystem version in the PE header, so it doesn’t
> matter what the value is. You can build a driver with win8 as the os
> target and load it on win7 if everything aligns (note that you must
> probably do this aligning yourself). This is unlike user mode where
> the user mode loader will look at the subsystem version and fail
> versions that are newer than the OS
>
> -----Original Message-----

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

24

Oops! Missed

Will try the procedure link said.

Thanks again.
Woojung

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of Skywing [xxxxx@valhallalegends.com]
Sent: Wednesday, August 29, 2012 10:08 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

This does not (today) cause a failure to load an image in kernel mode.

One cannot, however, map an image section to run in user mode if the subsystem version is greater than the OS version.

It is possible to target a driver for a downlevel version of the OS and still use uplevel features, but you have to exercise caution when doing so as the build system cannot add in build breaks in this case if you try to take a hardcoded dependency on features not available on earlier OS versions. The way to think about this is that the build environment, by default, semantically treats the target OS version as the *minimum* OS version that you will want to support (which makes sense when you are using, for example, new driver model capabilities not present on older releases). All of the build environment compile and link time safeguards are really set up to work like this.

All of this can trip you up if you aren’t careful when telling the build system that you’re going to play with fire and take matters into your own hands with targeting an OS version that isn’t really the minimum OS version that your driver needs to run on. For example:

This is probably what has happened to the OP here.

  • You can inadvertently pass parameters to OS functions in a way that wasn’t supported downlevel, which might result in runtime conditions that you don’t expect - the headers will not cause you to get a build break at compile time if the minimum OS version is not your target OS version

Usually, you have to carefully check the documentation to ensure that you don’t accidentally do this, as there is no load time check to save you (read: fail to load your driver) if you make a mistake. Some features that become available only when a driver runs on more recent OS versions have compile time options to make this easier to manage with respect to older OS version support, like the POOL_NX_OPTIN support for porting drivers to use the more secure NonPagedPoolNx (http://msdn.microsoft.com/en-us/library/windows/hardware/hh920393(v=vs.85).aspx ).

  • Code added to your binary by the build environment might assume that it is running on what you have told the build system is the “target” OS version. One example for Windows 8, that Doron alluded to several times in this thread, is that you’ll have to change the /GS security cookie stub library linked in to your driver to the downlevel-aware flavor if you plan to run on old OS’s but still tell the build system that you are going to “target” Windows 8 - or you’d get a bugcheck 0x139 / type 6 when starting the driver downlevel < http://msdn.microsoft.com/en-us/library/windows/hardware/jj569891(v=vs.85).aspx > ).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Wednesday, August 29, 2012 2:55 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

It might be a usermode binary. IIRC Skywing once wrote about this.
Usually I can run drivers built for Win7 target on Vista (SP1), but not usermode stuff.
– pa

On 30-Aug-2012 00:00, Vodicka, Michal wrote:

Strange. I’m almost sure that I had a problem with driver (not boot one) loading just because of this. But maybe I don’t remember it correctly and it was a user mode binary…

Michal

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-511990-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Wednesday, August 29, 2012 10:31 PM
> To: Windows System Software Devs Interest List
> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> I had the same misconception until recently. Mm in kernel mode
> doesn’t look at the subsystem version in the PE header, so it doesn’t
> matter what the value is. You can build a driver with win8 as the os
> target and load it on win7 if everything aligns (note that you must
> probably do this aligning yourself). This is unlike user mode where
> the user mode loader will look at the subsystem version and fail
> versions that are newer than the OS
>
> -----Original Message-----

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

25

Why are you dynamically loading your driver with ZwLoadDriver instead of creating a Driver DLL, importing by name and letting the OS load the second driver for you. Why is one driver a boot driver and the other is loaded later?

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Woojung Huh
Sent: Wednesday, August 29, 2012 8:26 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

Oops! Missed

Will try the procedure link said.

Thanks again.
Woojung

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of Skywing [xxxxx@valhallalegends.com]
Sent: Wednesday, August 29, 2012 10:08 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

This does not (today) cause a failure to load an image in kernel mode.

One cannot, however, map an image section to run in user mode if the subsystem version is greater than the OS version.

It is possible to target a driver for a downlevel version of the OS and still use uplevel features, but you have to exercise caution when doing so as the build system cannot add in build breaks in this case if you try to take a hardcoded dependency on features not available on earlier OS versions. The way to think about this is that the build environment, by default, semantically treats the target OS version as the *minimum* OS version that you will want to support (which makes sense when you are using, for example, new driver model capabilities not present on older releases). All of the build environment compile and link time safeguards are really set up to work like this.

All of this can trip you up if you aren’t careful when telling the build system that you’re going to play with fire and take matters into your own hands with targeting an OS version that isn’t really the minimum OS version that your driver needs to run on. For example:

This is probably what has happened to the OP here.

  • You can inadvertently pass parameters to OS functions in a way that wasn’t supported downlevel, which might result in runtime conditions that you don’t expect - the headers will not cause you to get a build break at compile time if the minimum OS version is not your target OS version

Usually, you have to carefully check the documentation to ensure that you don’t accidentally do this, as there is no load time check to save you (read: fail to load your driver) if you make a mistake. Some features that become available only when a driver runs on more recent OS versions have compile time options to make this easier to manage with respect to older OS version support, like the POOL_NX_OPTIN support for porting drivers to use the more secure NonPagedPoolNx (http://msdn.microsoft.com/en-us/library/windows/hardware/hh920393(v=vs.85).aspx ).

  • Code added to your binary by the build environment might assume that it is running on what you have told the build system is the “target” OS version. One example for Windows 8, that Doron alluded to several times in this thread, is that you’ll have to change the /GS security cookie stub library linked in to your driver to the downlevel-aware flavor if you plan to run on old OS’s but still tell the build system that you are going to “target” Windows 8 - or you’d get a bugcheck 0x139 / type 6 when starting the driver downlevel < http://msdn.microsoft.com/en-us/library/windows/hardware/jj569891(v=vs.85).aspx > ).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Wednesday, August 29, 2012 2:55 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

It might be a usermode binary. IIRC Skywing once wrote about this.
Usually I can run drivers built for Win7 target on Vista (SP1), but not usermode stuff.
– pa

On 30-Aug-2012 00:00, Vodicka, Michal wrote:

Strange. I’m almost sure that I had a problem with driver (not boot one) loading just because of this. But maybe I don’t remember it correctly and it was a user mode binary…

Michal

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-511990-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Wednesday, August 29, 2012 10:31 PM
> To: Windows System Software Devs Interest List
> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> I had the same misconception until recently. Mm in kernel mode
> doesn’t look at the subsystem version in the PE header, so it doesn’t
> matter what the value is. You can build a driver with win8 as the os
> target and load it on win7 if everything aligns (note that you must
> probably do this aligning yourself). This is unlike user mode where
> the user mode loader will look at the subsystem version and fail
> versions that are newer than the OS
>
> -----Original Message-----

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

26

Also http://blogs.msdn.com/b/doronh/archive/2006/03/13/550844.aspx

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Woojung Huh
Sent: Wednesday, August 29, 2012 8:26 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

Oops! Missed

Will try the procedure link said.

Thanks again.
Woojung

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of Skywing [xxxxx@valhallalegends.com]
Sent: Wednesday, August 29, 2012 10:08 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

This does not (today) cause a failure to load an image in kernel mode.

One cannot, however, map an image section to run in user mode if the subsystem version is greater than the OS version.

It is possible to target a driver for a downlevel version of the OS and still use uplevel features, but you have to exercise caution when doing so as the build system cannot add in build breaks in this case if you try to take a hardcoded dependency on features not available on earlier OS versions. The way to think about this is that the build environment, by default, semantically treats the target OS version as the *minimum* OS version that you will want to support (which makes sense when you are using, for example, new driver model capabilities not present on older releases). All of the build environment compile and link time safeguards are really set up to work like this.

All of this can trip you up if you aren’t careful when telling the build system that you’re going to play with fire and take matters into your own hands with targeting an OS version that isn’t really the minimum OS version that your driver needs to run on. For example:

This is probably what has happened to the OP here.

  • You can inadvertently pass parameters to OS functions in a way that wasn’t supported downlevel, which might result in runtime conditions that you don’t expect - the headers will not cause you to get a build break at compile time if the minimum OS version is not your target OS version

Usually, you have to carefully check the documentation to ensure that you don’t accidentally do this, as there is no load time check to save you (read: fail to load your driver) if you make a mistake. Some features that become available only when a driver runs on more recent OS versions have compile time options to make this easier to manage with respect to older OS version support, like the POOL_NX_OPTIN support for porting drivers to use the more secure NonPagedPoolNx (http://msdn.microsoft.com/en-us/library/windows/hardware/hh920393(v=vs.85).aspx ).

  • Code added to your binary by the build environment might assume that it is running on what you have told the build system is the “target” OS version. One example for Windows 8, that Doron alluded to several times in this thread, is that you’ll have to change the /GS security cookie stub library linked in to your driver to the downlevel-aware flavor if you plan to run on old OS’s but still tell the build system that you are going to “target” Windows 8 - or you’d get a bugcheck 0x139 / type 6 when starting the driver downlevel < http://msdn.microsoft.com/en-us/library/windows/hardware/jj569891(v=vs.85).aspx > ).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Wednesday, August 29, 2012 2:55 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

It might be a usermode binary. IIRC Skywing once wrote about this.
Usually I can run drivers built for Win7 target on Vista (SP1), but not usermode stuff.
– pa

On 30-Aug-2012 00:00, Vodicka, Michal wrote:

Strange. I’m almost sure that I had a problem with driver (not boot one) loading just because of this. But maybe I don’t remember it correctly and it was a user mode binary…

Michal

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-511990-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Wednesday, August 29, 2012 10:31 PM
> To: Windows System Software Devs Interest List
> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> I had the same misconception until recently. Mm in kernel mode
> doesn’t look at the subsystem version in the PE header, so it doesn’t
> matter what the value is. You can build a driver with win8 as the os
> target and load it on win7 if everything aligns (note that you must
> probably do this aligning yourself). This is unlike user mode where
> the user mode loader will look at the subsystem version and fail
> versions that are newer than the OS
>
> -----Original Message-----

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

27

Isn’t easier to use Dependency Walker? (http://www.dependencywalker.com/)

Michal

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-512011-
xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Thursday, August 30, 2012 5:33 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

Also http://blogs.msdn.com/b/doronh/archive/2006/03/13/550844.aspx

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-512009-
xxxxx@lists.osr.com] On Behalf Of Woojung Huh
Sent: Wednesday, August 29, 2012 8:26 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

Oops! Missed

  • You can inadvertently pull in a static link dependency for an API that doesn’t
    exist downlevel - this would typically cause a
    STATUS_PROCEDURE_NOT_FOUND /
    STATUS_DRIVER_ENTRYPOINT_NOT_FOUND. Eliyas Yakub has some good tips
    for diagnosing what happened wrong here on the following thread:
    http://www.tech-
    archive.net/Archive/Development/microsoft.public.development.device.drivers
    /2006-02/msg00561.html

Will try the procedure link said.

Thanks again.
Woojung

From: xxxxx@lists.osr.com [bounce-512004-
xxxxx@lists.osr.com] on behalf of Skywing [xxxxx@valhallalegends.com]
Sent: Wednesday, August 29, 2012 10:08 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

This does not (today) cause a failure to load an image in kernel mode.

One cannot, however, map an image section to run in user mode if the
subsystem version is greater than the OS version.

It is possible to target a driver for a downlevel version of the OS and still use
uplevel features, but you have to exercise caution when doing so as the build
system cannot add in build breaks in this case if you try to take a hardcoded
dependency on features not available on earlier OS versions. The way to think
about this is that the build environment, by default, semantically treats the
target OS version as the *minimum* OS version that you will want to support
(which makes sense when you are using, for example, new driver model
capabilities not present on older releases). All of the build environment
compile and link time safeguards are really set up to work like this.

All of this can trip you up if you aren’t careful when telling the build system that
you’re going to play with fire and take matters into your own hands with
targeting an OS version that isn’t really the minimum OS version that your
driver needs to run on. For example:

  • You can inadvertently pull in a static link dependency for an API that doesn’t
    exist downlevel - this would typically cause a
    STATUS_PROCEDURE_NOT_FOUND /
    STATUS_DRIVER_ENTRYPOINT_NOT_FOUND. Eliyas Yakub has some good tips
    for diagnosing what happened wrong here on the following thread:
    http://www.tech-
    archive.net/Archive/Development/microsoft.public.development.device.drivers
    /2006-02/msg00561.html

This is probably what has happened to the OP here.

  • You can inadvertently pass parameters to OS functions in a way that wasn’t
    supported downlevel, which might result in runtime conditions that you don’t
    expect - the headers will not cause you to get a build break at compile time if
    the minimum OS version is not your target OS version

Usually, you have to carefully check the documentation to ensure that you don’t
accidentally do this, as there is no load time check to save you (read: fail to
load your driver) if you make a mistake. Some features that become available
only when a driver runs on more recent OS versions have compile time options
to make this easier to manage with respect to older OS version support, like the
POOL_NX_OPTIN support for porting drivers to use the more secure
NonPagedPoolNx (http://msdn.microsoft.com/en-
us/library/windows/hardware/hh920393(v=vs.85).aspx ).

  • Code added to your binary by the build environment might assume that it is
    running on what you have told the build system is the “target” OS version. One
    example for Windows 8, that Doron alluded to several times in this thread, is
    that you’ll have to change the /GS security cookie stub library linked in to your
    driver to the downlevel-aware flavor if you plan to run on old OS’s but still tell
    the build system that you are going to “target” Windows 8 - or you’d get a
    bugcheck 0x139 / type 6 when starting the driver downlevel <
    http://msdn.microsoft.com/en-
    us/library/windows/hardware/jj569891(v=vs.85).aspx > ).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-511998-
xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Wednesday, August 29, 2012 2:55 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

It might be a usermode binary. IIRC Skywing once wrote about this.
Usually I can run drivers built for Win7 target on Vista (SP1), but not usermode
stuff.
– pa

On 30-Aug-2012 00:00, Vodicka, Michal wrote:
> Strange. I’m almost sure that I had a problem with driver (not boot one)
loading just because of this. But maybe I don’t remember it correctly and it was
a user mode binary…
>
> Michal
>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com [mailto:bounce-511990-
>> xxxxx@lists.osr.com] On Behalf Of Doron Holan
>> Sent: Wednesday, August 29, 2012 10:31 PM
>> To: Windows System Software Devs Interest List
>> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
>> ZwLoadDriver
>>
>> I had the same misconception until recently. Mm in kernel mode
>> doesn’t look at the subsystem version in the PE header, so it doesn’t
>> matter what the value is. You can build a driver with win8 as the os
>> target and load it on win7 if everything aligns (note that you must
>> probably do this aligning yourself). This is unlike user mode where
>> the user mode loader will look at the subsystem version and fail
>> versions that are newer than the OS
>>
>> -----Original Message-----
>

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NOTE: The information in this message is intended for the personal and confidential use of the designated recipient(s) named above. To the extent the recipient(s) is/are bound by a non-disclosure agreement, or other agreement that contains an obligation of confidentiality, with AuthenTec, then this message and/or any attachments shall be considered confidential information and subject to the confidentiality terms of that agreement. If the reader of this message is not the intended recipient named above, you are notified that you have received this document in error, and any review, dissemination, distribution or copying of this message is strictly prohibited. If you have received this document in error, please delete the original message and notify the sender immediately.
Thank You!
AuthenTec, Inc. http://www.authentec.com/

28

Yes, depends on the tools you have available to you

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Vodicka, Michal
Sent: Wednesday, August 29, 2012 9:03 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

Isn’t easier to use Dependency Walker? (http://www.dependencywalker.com/)

Michal

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-512011-
xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Thursday, August 30, 2012 5:33 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
ZwLoadDriver

Also http://blogs.msdn.com/b/doronh/archive/2006/03/13/550844.aspx

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-512009-
xxxxx@lists.osr.com] On Behalf Of Woojung Huh
Sent: Wednesday, August 29, 2012 8:26 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
ZwLoadDriver

Oops! Missed

  • You can inadvertently pull in a static link dependency for an API
    that doesn’t exist downlevel - this would typically cause a
    STATUS_PROCEDURE_NOT_FOUND / STATUS_DRIVER_ENTRYPOINT_NOT_FOUND.
    Eliyas Yakub has some good tips for diagnosing what happened wrong
    here on the following thread:
    http://www.tech-
    archive.net/Archive/Development/microsoft.public.development.device.dr
    ivers
    /2006-02/msg00561.html

Will try the procedure link said.

Thanks again.
Woojung

From: xxxxx@lists.osr.com [bounce-512004-
xxxxx@lists.osr.com] on behalf of Skywing
[xxxxx@valhallalegends.com]
Sent: Wednesday, August 29, 2012 10:08 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
ZwLoadDriver

This does not (today) cause a failure to load an image in kernel mode.

One cannot, however, map an image section to run in user mode if the
subsystem version is greater than the OS version.

It is possible to target a driver for a downlevel version of the OS
and still use uplevel features, but you have to exercise caution when
doing so as the build system cannot add in build breaks in this case
if you try to take a hardcoded dependency on features not available on
earlier OS versions. The way to think about this is that the build
environment, by default, semantically treats the target OS version as
the *minimum* OS version that you will want to support (which makes
sense when you are using, for example, new driver model capabilities
not present on older releases). All of the build environment compile and link time safeguards are really set up to work like this.

All of this can trip you up if you aren’t careful when telling the
build system that you’re going to play with fire and take matters into
your own hands with targeting an OS version that isn’t really the
minimum OS version that your driver needs to run on. For example:

  • You can inadvertently pull in a static link dependency for an API
    that doesn’t exist downlevel - this would typically cause a
    STATUS_PROCEDURE_NOT_FOUND / STATUS_DRIVER_ENTRYPOINT_NOT_FOUND.
    Eliyas Yakub has some good tips for diagnosing what happened wrong
    here on the following thread:
    http://www.tech-
    archive.net/Archive/Development/microsoft.public.development.device.dr
    ivers
    /2006-02/msg00561.html

This is probably what has happened to the OP here.

  • You can inadvertently pass parameters to OS functions in a way that
    wasn’t supported downlevel, which might result in runtime conditions
    that you don’t expect - the headers will not cause you to get a build
    break at compile time if the minimum OS version is not your target OS
    version

Usually, you have to carefully check the documentation to ensure that
you don’t accidentally do this, as there is no load time check to save
you (read: fail to load your driver) if you make a mistake. Some
features that become available only when a driver runs on more recent
OS versions have compile time options to make this easier to manage
with respect to older OS version support, like the POOL_NX_OPTIN
support for porting drivers to use the more secure NonPagedPoolNx
(http://msdn.microsoft.com/en- us/library/windows/hardware/hh920393(v=vs.85).aspx ).

  • Code added to your binary by the build environment might assume that
    it is running on what you have told the build system is the “target”
    OS version. One example for Windows 8, that Doron alluded to several
    times in this thread, is that you’ll have to change the /GS security
    cookie stub library linked in to your driver to the downlevel-aware
    flavor if you plan to run on old OS’s but still tell the build system
    that you are going to “target” Windows 8 - or you’d get a bugcheck
    0x139 / type 6 when starting the driver downlevel <
    http://msdn.microsoft.com/en-
    us/library/windows/hardware/jj569891(v=vs.85).aspx > ).

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-511998-
xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Wednesday, August 29, 2012 2:55 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

It might be a usermode binary. IIRC Skywing once wrote about this.
Usually I can run drivers built for Win7 target on Vista (SP1), but
not usermode stuff.
– pa

On 30-Aug-2012 00:00, Vodicka, Michal wrote:
> Strange. I’m almost sure that I had a problem with driver (not boot
> one)
loading just because of this. But maybe I don’t remember it correctly
and it was a user mode binary…
>
> Michal
>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com [mailto:bounce-511990-
>> xxxxx@lists.osr.com] On Behalf Of Doron Holan
>> Sent: Wednesday, August 29, 2012 10:31 PM
>> To: Windows System Software Devs Interest List
>> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
>> ZwLoadDriver
>>
>> I had the same misconception until recently. Mm in kernel mode
>> doesn’t look at the subsystem version in the PE header, so it
>> doesn’t matter what the value is. You can build a driver with win8
>> as the os target and load it on win7 if everything aligns (note
>> that you must probably do this aligning yourself). This is unlike
>> user mode where the user mode loader will look at the subsystem
>> version and fail versions that are newer than the OS
>>
>> -----Original Message-----
>

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NOTE: The information in this message is intended for the personal and confidential use of the designated recipient(s) named above. To the extent the recipient(s) is/are bound by a non-disclosure agreement, or other agreement that contains an obligation of confidentiality, with AuthenTec, then this message and/or any attachments shall be considered confidential information and subject to the confidentiality terms of that agreement. If the reader of this message is not the intended recipient named above, you are notified that you have received this document in error, and any review, dissemination, distribution or copying of this message is strictly prohibited. If you have received this document in error, please delete the original message and notify the sender immediately.
Thank You!
AuthenTec, Inc. http://www.authentec.com/

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

29

Guys,
Thanks for all your helps.
Sorry about not being able to open more details to you. :frowning:
I’ll dig more based on your feedbacks.

Woojung

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-512015-
xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Thursday, August 30, 2012 12:10 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
ZwLoadDriver

Yes, depends on the tools you have available to you

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-512014-
xxxxx@lists.osr.com] On Behalf Of Vodicka, Michal
Sent: Wednesday, August 29, 2012 9:03 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
ZwLoadDriver

Isn’t easier to use Dependency Walker?
(http://www.dependencywalker.com/)

Michal

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-512011-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Thursday, August 30, 2012 5:33 AM
> To: Windows System Software Devs Interest List
> Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> Also http://blogs.msdn.com/b/doronh/archive/2006/03/13/550844.aspx
>
> d
>
> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-512009-
> xxxxx@lists.osr.com] On Behalf Of Woojung Huh
> Sent: Wednesday, August 29, 2012 8:26 PM
> To: Windows System Software Devs Interest List
> Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> Oops! Missed
> - You can inadvertently pull in a static link dependency for an API
> that doesn’t exist downlevel - this would typically cause a
> STATUS_PROCEDURE_NOT_FOUND /
STATUS_DRIVER_ENTRYPOINT_NOT_FOUND.
> Eliyas Yakub has some good tips for diagnosing what happened wrong
> here on the following thread:
> http://www.tech-
>
archive.net/Archive/Development/microsoft.public.development.device.dr
> ivers
> /2006-02/msg00561.html
>
> Will try the procedure link said.
>
> Thanks again.
> Woojung
>
> ________________________________________
> From: xxxxx@lists.osr.com [bounce-512004-
> xxxxx@lists.osr.com] on behalf of Skywing
> [xxxxx@valhallalegends.com]
> Sent: Wednesday, August 29, 2012 10:08 PM
> To: Windows System Software Devs Interest List
> Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> This does not (today) cause a failure to load an image in kernel mode.
>
> One cannot, however, map an image section to run in user mode if the
> subsystem version is greater than the OS version.
>
> It is possible to target a driver for a downlevel version of the OS
> and still use uplevel features, but you have to exercise caution when
> doing so as the build system cannot add in build breaks in this case
> if you try to take a hardcoded dependency on features not available on
> earlier OS versions. The way to think about this is that the build
> environment, by default, semantically treats the target OS version as
> the *minimum* OS version that you will want to support (which makes
> sense when you are using, for example, new driver model capabilities
> not present on older releases). All of the build environment compile and
link time safeguards are really set up to work like this.
>
> All of this can trip you up if you aren’t careful when telling the
> build system that you’re going to play with fire and take matters into
> your own hands with targeting an OS version that isn’t really the
> minimum OS version that your driver needs to run on. For example:
>
> - You can inadvertently pull in a static link dependency for an API
> that doesn’t exist downlevel - this would typically cause a
> STATUS_PROCEDURE_NOT_FOUND /
STATUS_DRIVER_ENTRYPOINT_NOT_FOUND.
> Eliyas Yakub has some good tips for diagnosing what happened wrong
> here on the following thread:
> http://www.tech-
>
archive.net/Archive/Development/microsoft.public.development.device.dr
> ivers
> /2006-02/msg00561.html
>
> This is probably what has happened to the OP here.
>
>
> - You can inadvertently pass parameters to OS functions in a way that
> wasn’t supported downlevel, which might result in runtime conditions
> that you don’t expect - the headers will not cause you to get a build
> break at compile time if the minimum OS version is not your target OS
> version
>
> Usually, you have to carefully check the documentation to ensure that
> you don’t accidentally do this, as there is no load time check to save
> you (read: fail to load your driver) if you make a mistake. Some
> features that become available only when a driver runs on more recent
> OS versions have compile time options to make this easier to manage
> with respect to older OS version support, like the POOL_NX_OPTIN
> support for porting drivers to use the more secure NonPagedPoolNx
> (http://msdn.microsoft.com/en-
us/library/windows/hardware/hh920393(v=vs.85).aspx ).
>
>
> - Code added to your binary by the build environment might assume that
> it is running on what you have told the build system is the “target”
> OS version. One example for Windows 8, that Doron alluded to several
> times in this thread, is that you’ll have to change the /GS security
> cookie stub library linked in to your driver to the downlevel-aware
> flavor if you plan to run on old OS’s but still tell the build system
> that you are going to “target” Windows 8 - or you’d get a bugcheck
> 0x139 / type 6 when starting the driver downlevel <
> http://msdn.microsoft.com/en-
> us/library/windows/hardware/jj569891(v=vs.85).aspx > ).
>
>
> - S (Msft)
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-511998-
> xxxxx@lists.osr.com] On Behalf Of Pavel A
> Sent: Wednesday, August 29, 2012 2:55 PM
> To: Windows System Software Devs Interest List
> Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver
>
> It might be a usermode binary. IIRC Skywing once wrote about this.
> Usually I can run drivers built for Win7 target on Vista (SP1), but
> not usermode stuff.
> – pa
>
> On 30-Aug-2012 00:00, Vodicka, Michal wrote:
> > Strange. I’m almost sure that I had a problem with driver (not boot
> > one)
> loading just because of this. But maybe I don’t remember it correctly
> and it was a user mode binary…
> >
> > Michal
> >
> >> -----Original Message-----
> >> From: xxxxx@lists.osr.com [mailto:bounce-511990-
> >> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> >> Sent: Wednesday, August 29, 2012 10:31 PM
> >> To: Windows System Software Devs Interest List
> >> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
> >> ZwLoadDriver
> >>
> >> I had the same misconception until recently. Mm in kernel mode
> >> doesn’t look at the subsystem version in the PE header, so it
> >> doesn’t matter what the value is. You can build a driver with win8
> >> as the os target and load it on win7 if everything aligns (note
> >> that you must probably do this aligning yourself). This is unlike
> >> user mode where the user mode loader will look at the subsystem
> >> version and fail versions that are newer than the OS
> >>
> >> -----Original Message-----
> >
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

NOTE: The information in this message is intended for the personal and
confidential use of the designated recipient(s) named above. To the extent
the recipient(s) is/are bound by a non-disclosure agreement, or other
agreement that contains an obligation of confidentiality, with AuthenTec,
then this message and/or any attachments shall be considered confidential
information and subject to the confidentiality terms of that agreement. If
the reader of this message is not the intended recipient named above, you
are notified that you have received this document in error, and any review,
dissemination, distribution or copying of this message is strictly prohibited. If
you have received this document in error, please delete the original message
and notify the sender immediately.
Thank You!
AuthenTec, Inc. http://www.authentec.com/

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

30

With helps from all of you, I found out the reason failing to load my driver by ZwLoadDriver().

Root cause was by memcmp which is part of ntoskrnl in Windows 8, even though I’m not calling memcmp explicitly from my driver at all.
(I believe memcpy, memchr & memmove are in it, but memcmp wasn’t on other OSes.)

More digging shows me that it is from IsEqualGUID() in GUIDDef.h.
Replacing to InlineIsEqualGUID() resolves issue and I can load Win8-WDK-built driver on Win7. (Yes, link with BufferOverflowK.lib)
My system can use a single binary for all OSes now!

Thanks again for all your valuable feedbacks.
Woojung

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-512051-
xxxxx@lists.osr.com] On Behalf Of xxxxx@smsc.com
Sent: Thursday, August 30, 2012 9:09 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
ZwLoadDriver

Guys,
Thanks for all your helps.
Sorry about not being able to open more details to you. :frowning:
I’ll dig more based on your feedbacks.

Woojung

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-512015-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Thursday, August 30, 2012 12:10 AM
> To: Windows System Software Devs Interest List
> Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> Yes, depends on the tools you have available to you
>
> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-512014-
> xxxxx@lists.osr.com] On Behalf Of Vodicka, Michal
> Sent: Wednesday, August 29, 2012 9:03 PM
> To: Windows System Software Devs Interest List
> Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> ZwLoadDriver
>
> Isn’t easier to use Dependency Walker?
> (http://www.dependencywalker.com/)
>
> Michal
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:bounce-512011-
> > xxxxx@lists.osr.com] On Behalf Of Doron Holan
> > Sent: Thursday, August 30, 2012 5:33 AM
> > To: Windows System Software Devs Interest List
> > Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> > ZwLoadDriver
> >
> > Also http://blogs.msdn.com/b/doronh/archive/2006/03/13/550844.aspx
> >
> > d
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:bounce-512009-
> > xxxxx@lists.osr.com] On Behalf Of Woojung Huh
> > Sent: Wednesday, August 29, 2012 8:26 PM
> > To: Windows System Software Devs Interest List
> > Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> > ZwLoadDriver
> >
> > Oops! Missed
> > - You can inadvertently pull in a static link dependency for an API
> > that doesn’t exist downlevel - this would typically cause a
> > STATUS_PROCEDURE_NOT_FOUND /
> STATUS_DRIVER_ENTRYPOINT_NOT_FOUND.
> > Eliyas Yakub has some good tips for diagnosing what happened wrong
> > here on the following thread:
> > http://www.tech-
> >
>
archive.net/Archive/Development/microsoft.public.development.device.dr
> > ivers
> > /2006-02/msg00561.html
> >
> > Will try the procedure link said.
> >
> > Thanks again.
> > Woojung
> >
> > ________________________________________
> > From: xxxxx@lists.osr.com [bounce-512004-
> > xxxxx@lists.osr.com] on behalf of Skywing
> > [xxxxx@valhallalegends.com]
> > Sent: Wednesday, August 29, 2012 10:08 PM
> > To: Windows System Software Devs Interest List
> > Subject: RE: Re:[ntdev] Load Windows 8 driver on Windows 7 by
> > ZwLoadDriver
> >
> > This does not (today) cause a failure to load an image in kernel mode.
> >
> > One cannot, however, map an image section to run in user mode if the
> > subsystem version is greater than the OS version.
> >
> > It is possible to target a driver for a downlevel version of the OS
> > and still use uplevel features, but you have to exercise caution when
> > doing so as the build system cannot add in build breaks in this case
> > if you try to take a hardcoded dependency on features not available on
> > earlier OS versions. The way to think about this is that the build
> > environment, by default, semantically treats the target OS version as
> > the *minimum* OS version that you will want to support (which makes
> > sense when you are using, for example, new driver model capabilities
> > not present on older releases). All of the build environment compile and
> link time safeguards are really set up to work like this.
> >
> > All of this can trip you up if you aren’t careful when telling the
> > build system that you’re going to play with fire and take matters into
> > your own hands with targeting an OS version that isn’t really the
> > minimum OS version that your driver needs to run on. For example:
> >
> > - You can inadvertently pull in a static link dependency for an API
> > that doesn’t exist downlevel - this would typically cause a
> > STATUS_PROCEDURE_NOT_FOUND /
> STATUS_DRIVER_ENTRYPOINT_NOT_FOUND.
> > Eliyas Yakub has some good tips for diagnosing what happened wrong
> > here on the following thread:
> > http://www.tech-
> >
>
archive.net/Archive/Development/microsoft.public.development.device.dr
> > ivers
> > /2006-02/msg00561.html
> >
> > This is probably what has happened to the OP here.
> >
> >
> > - You can inadvertently pass parameters to OS functions in a way that
> > wasn’t supported downlevel, which might result in runtime conditions
> > that you don’t expect - the headers will not cause you to get a build
> > break at compile time if the minimum OS version is not your target OS
> > version
> >
> > Usually, you have to carefully check the documentation to ensure that
> > you don’t accidentally do this, as there is no load time check to save
> > you (read: fail to load your driver) if you make a mistake. Some
> > features that become available only when a driver runs on more recent
> > OS versions have compile time options to make this easier to manage
> > with respect to older OS version support, like the POOL_NX_OPTIN
> > support for porting drivers to use the more secure NonPagedPoolNx
> > (http://msdn.microsoft.com/en-
> us/library/windows/hardware/hh920393(v=vs.85).aspx ).
> >
> >
> > - Code added to your binary by the build environment might assume that
> > it is running on what you have told the build system is the “target”
> > OS version. One example for Windows 8, that Doron alluded to several
> > times in this thread, is that you’ll have to change the /GS security
> > cookie stub library linked in to your driver to the downlevel-aware
> > flavor if you plan to run on old OS’s but still tell the build system
> > that you are going to “target” Windows 8 - or you’d get a bugcheck
> > 0x139 / type 6 when starting the driver downlevel <
> > http://msdn.microsoft.com/en-
> > us/library/windows/hardware/jj569891(v=vs.85).aspx > ).
> >
> >
> > - S (Msft)
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:bounce-511998-
> > xxxxx@lists.osr.com] On Behalf Of Pavel A
> > Sent: Wednesday, August 29, 2012 2:55 PM
> > To: Windows System Software Devs Interest List
> > Subject: Re:[ntdev] Load Windows 8 driver on Windows 7 by
ZwLoadDriver
> >
> > It might be a usermode binary. IIRC Skywing once wrote about this.
> > Usually I can run drivers built for Win7 target on Vista (SP1), but
> > not usermode stuff.
> > – pa
> >
> > On 30-Aug-2012 00:00, Vodicka, Michal wrote:
> > > Strange. I’m almost sure that I had a problem with driver (not boot
> > > one)
> > loading just because of this. But maybe I don’t remember it correctly
> > and it was a user mode binary…
> > >
> > > Michal
> > >
> > >> -----Original Message-----
> > >> From: xxxxx@lists.osr.com [mailto:bounce-511990-
> > >> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> > >> Sent: Wednesday, August 29, 2012 10:31 PM
> > >> To: Windows System Software Devs Interest List
> > >> Subject: RE: RE:[ntdev] RE:Re:Load Windows 8 driver on Windows 7 by
> > >> ZwLoadDriver
> > >>
> > >> I had the same misconception until recently. Mm in kernel mode
> > >> doesn’t look at the subsystem version in the PE header, so it
> > >> doesn’t matter what the value is. You can build a driver with win8
> > >> as the os target and load it on win7 if everything aligns (note
> > >> that you must probably do this aligning yourself). This is unlike
> > >> user mode where the user mode loader will look at the subsystem
> > >> version and fail versions that are newer than the OS
> > >>
> > >> -----Original Message-----
> > >
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
> >
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
>
> NOTE: The information in this message is intended for the personal and
> confidential use of the designated recipient(s) named above. To the extent
> the recipient(s) is/are bound by a non-disclosure agreement, or other
> agreement that contains an obligation of confidentiality, with AuthenTec,
> then this message and/or any attachments shall be considered confidential
> information and subject to the confidentiality terms of that agreement. If
> the reader of this message is not the intended recipient named above, you
> are notified that you have received this document in error, and any review,
> dissemination, distribution or copying of this message is strictly prohibited.
If
> you have received this document in error, please delete the original
message
> and notify the sender immediately.
> Thank You!
> AuthenTec, Inc. http://www.authentec.com/
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

31

Congrats Mr. Huh. And thanks for posting the details of why your driver didn’t load. I never would have suspected IsEqualGUID.

Thanks also to Doron and Ken for what *I* found to be the most informative thread on NTDEV in a while.

Lots of us in the community, like Mr. Huh, want to ship a single binary (I mean, who wouldn’t want to do that)… and we have drivers that use new features on up-level platforms, and use older features on the down-level platforms. Getting drivers built in the Win8 WDK, specifying Win8 as a target, to run down-level is going to be a task that a lot of us face. I’m grateful for the info that’s been posted here in this thread, because I suspect it’s going to save a lot of people a lot of work.

Thanks all,

Peter
OSR

32

Hi Peter,

I’m glad that conversation would be helpful to others who may face same problem.
And, thanks again to Horon , Skywing and others sharing good information.

Woojung

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of xxxxx@osr.com [xxxxx@osr.com]
Sent: Friday, August 31, 2012 11:58 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Load Windows 8 driver on Windows 7 by ZwLoadDriver

Congrats Mr. Huh. And thanks for posting the details of why your driver didn’t load. I never would have suspected IsEqualGUID.

Thanks also to Doron and Ken for what *I* found to be the most informative thread on NTDEV in a while.

Lots of us in the community, like Mr. Huh, want to ship a single binary (I mean, who wouldn’t want to do that)… and we have drivers that use new features on up-level platforms, and use older features on the down-level platforms. Getting drivers built in the Win8 WDK, specifying Win8 as a target, to run down-level is going to be a task that a lot of us face. I’m grateful for the info that’s been posted here in this thread, because I suspect it’s going to save a lot of people a lot of work.

Thanks all,

Peter
OSR

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer