WinUsb and WHQL signing
in [Device Drivers]
|
Prev: Why the disk driver (disk.sys) can not receive a PDO(physical device object) that is created by a class(disk) low filter driver?
Next: Can't sign my file properlly
From: Morten Guld Morten on 3 Nov 2009 08:51 We want to preinstall our driver so that the driver will install silently (no found new hardware wizard or do you trust company X) when the user plugs in the usb device. The driver basicly consist of a INF file which associates our device with the WinUsb driver. In order to be able to fullfill our requirements we understand that we need to go through the Windows Logo Program and get a WHQL signature for the driver (- this is a bit odd because the WinUsb driver is already WHQL signed). Is this correct or is there another way to get arround this? We do not require a Windows Logo on our usb devices. We just want to get rid of any user interaction during installation. We quess that what we need is the Unclassified Signature Program (http://msdn.microsoft.com/en-us/library/dd424561.aspx). We will have to support Windows XP, Vista and Windows 7 (all 32 bit versions). What efford should we expect to pass the DTM tests? Can we perform the test on a single PC or do we need a larger test setup? If a test fails do we then need to rerun the entire test or only the one that failed. /Morten
From: David Craig on 3 Nov 2009 12:58 Read the WHQL web site. Follow the instructions there. Forget 32-bit only submissions. 64-bit is REQUIRED. A lot of effort until you understand how it just works. "Morten Guld" <Morten Guld(a)discussions.microsoft.com> wrote in message news:C1F198F9-0B49-4A73-9516-7D9D46E99C22(a)microsoft.com... > We want to preinstall our driver so that the driver will install silently > (no > found new hardware wizard or do you trust company X) when the user plugs > in > the usb device. The driver basicly consist of a INF file which associates > our > device with the WinUsb driver. > > In order to be able to fullfill our requirements we understand that we > need > to go through the Windows Logo Program and get a WHQL signature for the > driver (- this is a bit odd because the WinUsb driver is already WHQL > signed). Is this correct or is there another way to get arround this? > > We do not require a Windows Logo on our usb devices. We just want to get > rid > of any user interaction during installation. We quess that what we need is > the Unclassified Signature Program > (http://msdn.microsoft.com/en-us/library/dd424561.aspx). > > We will have to support Windows XP, Vista and Windows 7 (all 32 bit > versions). What efford should we expect to pass the DTM tests? > > Can we perform the test on a single PC or do we need a larger test setup? > If > a test fails do we then need to rerun the entire test or only the one that > failed. > > /Morten
From: Hannes on 6 Nov 2009 09:16 Hi Morten, A couple of comments from our experience: The VID/PID for your device, or a USB class name, will decide what driver will be loaded. If a matching driver is not shipped in-box with Windows (XP/Vista/7) then you need to provide it on some sort of media (some clever devices actually present themselves as a standard CD-ROM in order to automatically load and launch driver installation files located on them). If drivers are not found then your installation can of course not be silent. To avoid "Do you trust..." etc popups, your drivers need to be WHQL tested and signed. This is true also if you write your own INF that utilizes an in-box .sys file. The in-box file may be signed already, but it has not been tested against your particular hardware, which is why you need to run WHQL tests to get signature. Select the WHQL tests tht are the closest mach to your device. If you find no matching device class, then use the Unclassified test suite. I think you need to execute WHQL test suites on every OS you want log for, i.e. XP-32, XP-64, Vista-32, Vista-64, Win7-2, Win7-64 - so 6 test suites in all. If you want to install these OSes on only one PC, that is possible but may also take a long time. You can save time by using 6 separate machines. Hope this helps, / Hannes. "Morten Guld" wrote: > We want to preinstall our driver so that the driver will install silently (no > found new hardware wizard or do you trust company X) when the user plugs in > the usb device. The driver basicly consist of a INF file which associates our > device with the WinUsb driver. > > In order to be able to fullfill our requirements we understand that we need > to go through the Windows Logo Program and get a WHQL signature for the > driver (- this is a bit odd because the WinUsb driver is already WHQL > signed). Is this correct or is there another way to get arround this? > > We do not require a Windows Logo on our usb devices. We just want to get rid > of any user interaction during installation. We quess that what we need is > the Unclassified Signature Program > (http://msdn.microsoft.com/en-us/library/dd424561.aspx). > > We will have to support Windows XP, Vista and Windows 7 (all 32 bit > versions). What efford should we expect to pass the DTM tests? > > Can we perform the test on a single PC or do we need a larger test setup? If > a test fails do we then need to rerun the entire test or only the one that > failed. > > /Morten
From: Denis on 9 Nov 2009 15:45 You are miss leading... I had a hard time because of miss lead like this. 64 Bit Vista/7 The Logo certification is not mandatory in order to load a USB driver. In order to load the package must be signed with a KMCS signature. The KMCS signature is made based on a certification purchased from an authorized CA vendor, and a Cross Certificate obtain found at: http://www.microsoft.com/whdc/winlogo/drvsign/crosscert.mspx Must also use the signtool provided in the latest WDK (such as WDK 7600.16385.0) Another thing you can only sign with the computer that the CA certificate was issued. This example is with a VeriSign spc. SignTool sign /v /ac C:\VeriSign\MSCV-VSClass3.cer /s my /n "YOUR CORPORATION REGISTERD TO CA" /t http://timestamp.verisign.com/scripts/timestamp.dll YourUsb.sys to verify : Signtool verify /kp /v yourusb.sys Then generate a cat file for your inf: Inf2Cat /driver:. /os:2000,XP_X86,XP_X64,Server2003_X86,Server2003_X64,Server2003_IA64,Vista_X86,Vista_X64 /v SignTool sign /v /ac C:\VeriSign\MSCV-VSClass3.cer /s my /n "YOUR CORPORATION REGISTERD TO CA" /t http://timestamp.verisign.com/scripts/timestamp.dll YourCat.cat to verify : Signtool verify /kp /v /c yourusb.cat yourusb.sys That is all that is needed. Denis p.s. Reinstalling a driver is a different issue. "Hannes" <hannes.news(a)newsgroup.nospam> wrote in message news:5C215B59-F991-467F-A3FA-9198360399D0(a)microsoft.com... > Hi Morten, > > A couple of comments from our experience: > > The VID/PID for your device, or a USB class name, will decide what driver > will be loaded. If a matching driver is not shipped in-box with Windows > (XP/Vista/7) then you need to provide it on some sort of media (some clever > devices actually present themselves as a standard CD-ROM in order to > automatically load and launch driver installation files located on them). If > drivers are not found then your installation can of course not be silent. > > To avoid "Do you trust..." etc popups, your drivers need to be WHQL tested > and signed. This is true also if you write your own INF that utilizes an > in-box .sys file. The in-box file may be signed already, but it has not been > tested against your particular hardware, which is why you need to run WHQL > tests to get signature. > > Select the WHQL tests tht are the closest mach to your device. If you find > no matching device class, then use the Unclassified test suite. > > I think you need to execute WHQL test suites on every OS you want log for, > i.e. > XP-32, XP-64, Vista-32, Vista-64, Win7-2, Win7-64 - so 6 test suites in all. > If you want to install these OSes on only one PC, that is possible but may > also take a long time. You can save time by using 6 separate machines. > > Hope this helps, > > / Hannes. > > > "Morten Guld" wrote: > >> We want to preinstall our driver so that the driver will install silently (no >> found new hardware wizard or do you trust company X) when the user plugs in >> the usb device. The driver basicly consist of a INF file which associates our >> device with the WinUsb driver. >> >> In order to be able to fullfill our requirements we understand that we need >> to go through the Windows Logo Program and get a WHQL signature for the >> driver (- this is a bit odd because the WinUsb driver is already WHQL >> signed). Is this correct or is there another way to get arround this? >> >> We do not require a Windows Logo on our usb devices. We just want to get rid >> of any user interaction during installation. We quess that what we need is >> the Unclassified Signature Program >> (http://msdn.microsoft.com/en-us/library/dd424561.aspx). >> >> We will have to support Windows XP, Vista and Windows 7 (all 32 bit >> versions). What efford should we expect to pass the DTM tests? >> >> Can we perform the test on a single PC or do we need a larger test setup? If >> a test fails do we then need to rerun the entire test or only the one that >> failed. >> >> /Morten
From: Mike [MSFT] on 10 Nov 2009 18:26
If you don't get a WHQL signature then you will still get a "do you trust" prompt when staging the driver to the system on Vista and Win 7. This is because the certificate would not yet be installed (trusted) on the machine. Though that would be a 1-time prompt that users would not see when plugging in devices that match that driver. On XP however a WHQL signature is required to avoid a "do you trust" prompt when the user plugs in a device that matches the driver. http://msdn.microsoft.com/en-us/library/aa906343.aspx -Mike "Denis @ TheOffice" <denisco(a)ica.net> wrote in message news:Of8Iu2XYKHA.3696(a)TK2MSFTNGP02.phx.gbl... > You are miss leading... > I had a hard time because of miss lead like this. > > 64 Bit Vista/7 > > The Logo certification is not mandatory in order to load a USB driver. > In order to load the package must be signed with a KMCS signature. > > The KMCS signature is made based on a certification purchased from an > authorized CA vendor, > and a Cross Certificate obtain found at: > http://www.microsoft.com/whdc/winlogo/drvsign/crosscert.mspx > > Must also use the signtool provided in the latest WDK (such as WDK > 7600.16385.0) > Another thing you can only sign with the computer that the CA certificate > was issued. > > This example is with a VeriSign spc. > > SignTool sign /v /ac C:\VeriSign\MSCV-VSClass3.cer /s my /n "YOUR > CORPORATION REGISTERD TO CA" /t > http://timestamp.verisign.com/scripts/timestamp.dll YourUsb.sys > to verify : Signtool verify /kp /v yourusb.sys > > Then generate a cat file for your inf: > Inf2Cat /driver:. > /os:2000,XP_X86,XP_X64,Server2003_X86,Server2003_X64,Server2003_IA64,Vista_X86,Vista_X64 > /v > > SignTool sign /v /ac C:\VeriSign\MSCV-VSClass3.cer /s my /n "YOUR > CORPORATION REGISTERD TO CA" /t > http://timestamp.verisign.com/scripts/timestamp.dll YourCat.cat > to verify : Signtool verify /kp /v /c yourusb.cat yourusb.sys > > That is all that is needed. > Denis > p.s. Reinstalling a driver is a different issue. > > > > "Hannes" <hannes.news(a)newsgroup.nospam> wrote in message > news:5C215B59-F991-467F-A3FA-9198360399D0(a)microsoft.com... >> Hi Morten, >> >> A couple of comments from our experience: >> >> The VID/PID for your device, or a USB class name, will decide what driver >> will be loaded. If a matching driver is not shipped in-box with Windows >> (XP/Vista/7) then you need to provide it on some sort of media (some >> clever >> devices actually present themselves as a standard CD-ROM in order to >> automatically load and launch driver installation files located on them). >> If >> drivers are not found then your installation can of course not be silent. >> >> To avoid "Do you trust..." etc popups, your drivers need to be WHQL >> tested >> and signed. This is true also if you write your own INF that utilizes an >> in-box .sys file. The in-box file may be signed already, but it has not >> been >> tested against your particular hardware, which is why you need to run >> WHQL >> tests to get signature. >> >> Select the WHQL tests tht are the closest mach to your device. If you >> find >> no matching device class, then use the Unclassified test suite. >> >> I think you need to execute WHQL test suites on every OS you want log >> for, >> i.e. >> XP-32, XP-64, Vista-32, Vista-64, Win7-2, Win7-64 - so 6 test suites in >> all. >> If you want to install these OSes on only one PC, that is possible but >> may >> also take a long time. You can save time by using 6 separate machines. >> >> Hope this helps, >> >> / Hannes. >> >> >> "Morten Guld" wrote: >> >>> We want to preinstall our driver so that the driver will install >>> silently (no >>> found new hardware wizard or do you trust company X) when the user plugs >>> in >>> the usb device. The driver basicly consist of a INF file which >>> associates our >>> device with the WinUsb driver. >>> >>> In order to be able to fullfill our requirements we understand that we >>> need >>> to go through the Windows Logo Program and get a WHQL signature for the >>> driver (- this is a bit odd because the WinUsb driver is already WHQL >>> signed). Is this correct or is there another way to get arround this? >>> >>> We do not require a Windows Logo on our usb devices. We just want to get >>> rid >>> of any user interaction during installation. We quess that what we need >>> is >>> the Unclassified Signature Program >>> (http://msdn.microsoft.com/en-us/library/dd424561.aspx). >>> >>> We will have to support Windows XP, Vista and Windows 7 (all 32 bit >>> versions). What efford should we expect to pass the DTM tests? >>> >>> Can we perform the test on a single PC or do we need a larger test >>> setup? If >>> a test fails do we then need to rerun the entire test or only the one >>> that >>> failed. >>> >>> /Morten > > |