Uninstall a filter driver

This filter driver is an open source driver: busdog, it’s installed through this command:
RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 objchk_wxp_x86\i386\busdog.inf

I need uninstall it because need add some new features, but do not want to copy/replace/reboot, from MSDN seems can add DefaultUninstall section, but how to stop the service first, there’s a thus flag SPSVCINST_STOPSERVICE. I know for some driver can use “sc stop sample_driver” to stop.

Below is the inf file:

[Version]
signature = “$Windows NT$”
DriverPackageType = ClassFilter
DriverVer=07/23/2012,0.2.0.0

[SourceDisksNames]
1 = %ClasFilt.MediaDesc%

[SourceDisksFiles]
busdog.sys = 1

[DestinationDirs]
DefaultDestDir = 12 ; DIRID_DRIVERS

[DefaultInstall.NT]
CopyFiles = @busdog.sys
AddReg = ClassFilter_AddReg

[ClassFilter_AddReg]
HKLM, System\CurrentControlSet\Control\Class%USB_CLASS_GUID%, LowerFilters, 0x00010008, busdog
HKLM, System\CurrentControlSet\Control\Class%HID_CLASS_GUID%, LowerFilters, 0x00010008, busdog
HKLM, System\CurrentControlSet\Control\Class%PORT_CLASS_GUID%, UpperFilters, 0x00010008, busdog

[DefaultInstall.NT.Services]
AddService = busdog, , clasfilt_Service_Inst, clasfilt_EventLog_Inst

[clasfilt_Service_Inst]
DisplayName = %ClasFilt.SvcDesc%
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_DEMAND_START%
ErrorControl = %SERVICE_ERROR_IGNORE%
ServiceBinary = %12%\busdog.sys

[clasfilt_EventLog_Inst]
AddReg = clasfilt_EventLog_AddReg

[clasfilt_EventLog_AddReg]
HKR,EventMessageFile, %REG_EXPAND_SZ%,“%%SystemRoot%%\System32\IoLogMsg.dll;%%SystemRoot%%\System32\drivers\busdog.sys”
HKR,TypesSupported, %REG_DWORD%, 7

;================================================================
;— WDF Coinstaller installation ------
;

[DestinationDirs]
CoInstaller_CopyFiles = 11

[DefaultInstall.NT.CoInstallers]
AddReg=CoInstaller_AddReg
CopyFiles=CoInstaller_CopyFiles

[CoInstaller_AddReg]
HKR,CoInstallers32,0x00010000,“WdfCoinstaller01009.dll,WdfCoInstaller”

[CoInstaller_CopyFiles]
WdfCoinstaller01009.dll,2

[SourceDisksFiles]
WdfCoInstaller01009.dll=99

[busdog.NT.Wdf]
KmdfService = busdog, busdog_wdfsect

[busdog_wdfsect]
KmdfLibraryVersion = 1.9

;================================================================
;— Misc ------
;

[Strings]
ClasFilt.SvcDesc = “BusDog Class Filter Driver”
ClasFilt.MediaDesc = “BusDog Class Filter Driver Disc”

; Useful constants
SERVICE_KERNEL_DRIVER = 1
SERVICE_DEMAND_START = 3
SERVICE_ERROR_IGNORE = 0
REG_EXPAND_SZ = 0x00020000
REG_DWORD = 0x00010001
USB_CLASS_GUID = {36FC9E60-C465-11CF-8056-444553540000}
HID_CLASS_GUID = {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
PORT_CLASS_GUID = {4D36E978-E325-11CE-BFC1-08002BE10318}

Thanks!

xxxxx@gmail.com wrote:

This filter driver is an open source driver: busdog, it’s installed through this command:
RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 objchk_wxp_x86\i386\busdog.inf

I need uninstall it because need add some new features, but do not want to copy/replace/reboot, from MSDN seems can add DefaultUninstall section, but how to stop the service first, there’s a thus flag SPSVCINST_STOPSERVICE. I know for some driver can use “sc stop sample_driver” to stop.

Remember that you don’t start and stop a driver – you start and stop a
device. You have to stop all of the devices that are USING the filter.
As long as any device stack is using the filter, it will never be
unloaded. In this case, because you’re filtering all USB, HID, and
ports class devices, that’s impossible. Your only choice is copy and
reboot.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.