[VISTA] Driver blocked from loading: why?

Hi,

I have a small and simple device driver that doesn't monitor any hardware.
It looks like the tracedrv sample from the WinDDK. This is a port from a
Win32 device driver. The source code compiles for the amd64 target without
any warning or error from the Windows Vista and Windows Server Longhorn x64
Free Build Environment.

This driver is not installed but dynamically loaded from a service (32-bit).
When the service tries to load this device driver, Vista "blocks it from
loading due to an incompatibility with this system". Which incompatibility?
It's an amd64 dual core system. The driver is not digitally signed for the
moment but I have started Vista with the Disable Digital Signing Enforcement
option.

I'm clueless. Any idea?

Thanks in advance.

--
Patrick Philippot
MainSoft Consulting Services
www.mainsoft.fr

Gianluca
Fri Apr 13 14:03:00 CDT 2007

For Vista x64 the driver should be signed, either a proper
signature+cross-signing (i.e. certificate issued by a certification
authority blessed by microsoft) or through test signing.

Please follow the guidelines for test signing in the Kernel Mode code
signing walkthrough available online at

http://www.microsoft.com/whdc/winlogo/drvsign/kmcs_walkthrough.mspx

Hope it helps
GV


"Patrick Philippot" <patrick.philippot@mainsoft.xx.fr> wrote in message
news:%23bA2hAffHHA.2432@TK2MSFTNGP03.phx.gbl...
> Hi,
>
> I have a small and simple device driver that doesn't monitor any hardware.
> It looks like the tracedrv sample from the WinDDK. This is a port from a
> Win32 device driver. The source code compiles for the amd64 target without
> any warning or error from the Windows Vista and Windows Server Longhorn
> x64 Free Build Environment.
>
> This driver is not installed but dynamically loaded from a service
> (32-bit). When the service tries to load this device driver, Vista "blocks
> it from loading due to an incompatibility with this system". Which
> incompatibility? It's an amd64 dual core system. The driver is not
> digitally signed for the moment but I have started Vista with the Disable
> Digital Signing Enforcement option.
>
> I'm clueless. Any idea?
>
> Thanks in advance.
>
> --
> Patrick Philippot
> MainSoft Consulting Services
> www.mainsoft.fr
>
>
>

Patrick
Sat Apr 14 01:31:31 CDT 2007

Hi Gianluca,

As I said:

> The driver is not digitally signed for the moment but I have started Vista
> with the Disable Digital Signing Enforcement option.

This option is here to allow driver development without signing it. This
feature is mentioned in the guidelines especially for this purpose. Do you
mean it doesn't work?

--
Patrick Philippot
MainSoft Consulting Services
www.mainsoft.fr

Patrick
Sat Apr 14 01:38:39 CDT 2007

> For Vista x64 the driver should be signed, either a proper
> signature+cross-signing (i.e. certificate issued by a certification
> authority blessed by microsoft) or through test signing.

Gianluca,

Look at this document:

http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/64bitDriverSigning.doc

"
How to Disable Signature Enforcement during Development

During the early stages of development, developers can disable enforcement
in Windows so that driver signing is unnecessary. The following options are
available for developers to temporarily disable kernel-mode code-signing
enforcement so that Windows Vista will load an unsigned driver.

- Attaching a kernel debugger. Attaching an active kernel debugger to the
target computer disables the enforcement of kernel-mode signatures in
Windows Vista and allows the driver to load.

- Using the F8 option. An F8 Advanced Boot Option introduced with Windows
Vista??Disable Driver Signature Enforcement??is available to disable the
kernel-signing enforcement only for the current boot session. This setting
does not persist across boot sessions.
"

I'm using option #2.

--
Patrick Philippot
MainSoft Consulting Services
www.mainsoft.fr

Patrick
Sat Apr 14 02:33:48 CDT 2007

OK. Problem solved. The application was not loading the correct driver.

By the way, I confirm that for testing, the device driver doesn't need to be
signed. It's just a matter of booting Vista with the option (F8) mentioned
above. However, when the driver is loaded, Vista opens a warning window
telling that the driver is not loaded. Which is not correct: the driver *is*
loaded and works.

--
Patrick Philippot - Microsoft MVP
MainSoft Consulting Services
www.mainsoft.fr

Gianluca
Tue Apr 17 10:31:05 CDT 2007

Ouch, I think I missed this document. I was working on the Vista x64 signing
issues before Vista went RTM, and the information was way more confused at
that time. I knew about the kernel debugger solution, but I always avoided
it because impractical.

Thanks for pointing out that document!

Ciao
GV

"Patrick Philippot" <patrick.philippot@mainsoft.xx.fr> wrote in message
news:%23vEW%239lfHHA.2396@TK2MSFTNGP04.phx.gbl...
>> For Vista x64 the driver should be signed, either a proper
>> signature+cross-signing (i.e. certificate issued by a certification
>> authority blessed by microsoft) or through test signing.
>
> Gianluca,
>
> Look at this document:
>
> http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/64bitDriverSigning.doc
>
> "
> How to Disable Signature Enforcement during Development
>
> During the early stages of development, developers can disable enforcement
> in Windows so that driver signing is unnecessary. The following options
> are available for developers to temporarily disable kernel-mode
> code-signing enforcement so that Windows Vista will load an unsigned
> driver.
>
> - Attaching a kernel debugger. Attaching an active kernel debugger to the
> target computer disables the enforcement of kernel-mode signatures in
> Windows Vista and allows the driver to load.
>
> - Using the F8 option. An F8 Advanced Boot Option introduced with Windows
> Vista??Disable Driver Signature Enforcement??is available to disable the
> kernel-signing enforcement only for the current boot session. This setting
> does not persist across boot sessions.
> "
>
> I'm using option #2.
>
> --
> Patrick Philippot
> MainSoft Consulting Services
> www.mainsoft.fr
>