Windows driver signing

NTDEV
1

We have quite an old driver for a pcie video capture board.
It is not signed, and we need to make it work on a Windows 8.1 64-bit platform (we checked that it worked by suppressing the signature check in Windows).
We don’t have sources and the manufacturer is not supporting the driver anymore.

So, … I need to sign this thing.
The more I read up on Windows driver signing procedures, the more confused I get.
We figured that we couldn’t go the WHCL way, and let Microsoft sign it.
So, I suppose we need to ‘cross sign it’ … (?)

Does anyone know where I can find a clear, step by step, description of what to do to get this driver signed?

I suppose the first step is buying a certificate … I have seen price ranges from a few hundred to a few thousand. What’s the difference? Any suggestions?

And what does it mean that those prices are ‘per year’? That has nothing to do with the expiration date of the certificate, does it?

Once I have such a certificate … can I use it for a bunch of different drivers (or even other executables?) as well, or are certificates tied to one product?

Any suggestions and/or pointers to clear instructions would be greatly appreciated.

~ Paul C

2

xxxxx@claessen.com xxxxx@lists.osr.com wrote:

We have quite an old driver for a pcie video capture board.
It is not signed, and we need to make it work on a Windows 8.1 64-bit platform (we checked that it worked by suppressing the signature check in Windows).

Hang on a minute.  The 64-bit systems have ALWAYS required signed
drivers.  Windows 8.1 is no different than XP64 in that respect.  How
has this driver ever worked for you?

The only difference in the Windows 8 world is that driver packages now
require a CAT file.  They didn’t before.

We don’t have sources and the manufacturer is not supporting the driver anymore.

So, … I need to sign this thing.
The more I read up on Windows driver signing procedures, the more confused I get.

As long as you don’t have to worry about Windows 10, the world is good.

 

We figured that we couldn’t go the WHCL way, and let Microsoft sign it.
So, I suppose we need to ‘cross sign it’ … (?)

Correct.

 

Does anyone know where I can find a clear, step by step, description of what to do to get this driver signed?

There used to be a white paper, but the process is not that
complicated.  You do need to acquire a class 3 code-signing certificate
from one of the code-signing authorities supported by Microsoft.  That’s
a fairly long list now:

   
https://docs.microsoft.com/en-us/windows-hardware/drivers/install/cross-certificates-for-kernel-mode-code-signing

Note that, unless you need to play in Windows 10, you don’t need an EV
certificate yet.

The vendor will send you instructions on putting your certificate in the
certificate store.  You will need to know the location and file name of
the cross certificate for your vendor.

So, you collect all the files for your project.  You sign the sys file:
    signtool sign /v /ac MSVC-GlobalSign.cer /sha XXXXXXXX /t
http://timestamp.verisign.com/scripts/timestamp.dll xxxxx.sys
You build a CAT file:
    inf2cat /driver: /os:7_X86,7_X64,8_X86,8_X64
You sign the CAT file:
   signtool sign /v /ac MSVC-GlobalSign.cer /sha XXXXXXXX /t
http://timestamp.verisign.com/scripts/timestamp.dll xxxxx.cat

That’s it. Note that I use the SHA thumbprint to select the right
certificate. There are other ways to choose a certificate, by name for
example. You’ll need to look at the “signtool sign” help info to find that.

Â
> I suppose the first step is buying a certificate … I have seen price ranges from a few hundred to a few thousand. What’s the difference? Any suggestions?

I like GlobalSign and they are affordable, but as long as the cert
vendor mentions kernel signing and is on Microsoft’s list, it should be
good.

Â
> And what does it mean that those prices are ‘per year’? That has nothing to do with the expiration date of the certificate, does it?

No. You can sign new packages until the certificate expires. As long
as you embed a timestamp, the signed package itself remains valid forever.

Â
> Once I have such a certificate … can I use it for a bunch of different drivers (or even other executables?) as well, or are certificates tied to one product?

You can sign as many things as you want.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Tim,

And again … thank you so much, that’s VERY helpful information!

As for your question:

"
Hang on a minute.? The 64-bit systems have ALWAYS required signed
drivers.? Windows 8.1 is no different than XP64 in that respect.? How
has this driver ever worked for you?
"

We’re upgrading a product for a customer, think of ruggedized tablet/laptop: it USED to run XP on a 32 bit processor. The new version has a 64 bit processor and runs Windows 8.1.

~ Paul C

4

And you have the 64-bit version of the driver?

You do understand that a 32-bit driver will not load on 64-bit Windows? I’m sure you know this… You said the driver does work earlier. But… you know… better to ask than to assume.

Peter
OSR
@OSRDrivers

5

Peter,

Yes, we have 32 bit and 64 bit drivers, provided by the manufacturer of the Video Capture chip.
And we already tried the 64 bit driver on the new, 64-bit, platform, on Windows 8.1 (with driver signature checking off) to make sure it would work. (And it did).

Thanks for making sure!
Love this forum already! :wink:

~ Paul C

6

So, the old paper that Mr. Roberts referenced is called “Kernel-Mode Code Signing Walkthrough”… and until MSFT changes the URL, you can find it here:

https:

This should walk you step-by-step through the basic signing process for signed/cross-signed drivers.

Attestation signing is entirely different…

Peter
OSR
@OSRDrivers</https:>

7

Peter,

Thanks for the link, … (I noticed that paper is 10 years old, so hopefully not too much has changed for Windows 8.1, 64 bit, as I understand that quite a few things DID change for Windows 10, when it comes to driver signing! … but oh well, that doesn’t concern me right now).

~ Paul C