[libwdi-devel] signing my INF file?

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

Dear Experts,

      I just started involving in Windows Driver Development, very freshly.
And stuggling a lot to finish my task.

It would really the greatest help if somebody take interest to answer my
below questions. My questions would be pretty big but all will be binary
answers(yes or no).

1. I am done developing an INF file with the windows default or native
driver USBSER.SYS (CDC ACM MOdel) for my device.Its working fine too...
   My another aim is to create a Automatic Dial-up network connection as
soon as the driver is installed as how the 3G Data Card/Modem's(USB Modem)
are working. A new Dial Up Connection will be created automatically
whenever the USB modem is plugged in, with the driver installed in the PC.
I heard that CDC ECM/CDC EEM models could be helpful, however there are no
defualt or Native drivers for ECM/EEM models from microsoft.Am i wrong?
In this case,Should the driver to be developed on our own to achieve my
intention(creating a dial up connection)? Or Are Anyother drivers available?

2. Please refer my inf file:

[Version]
DriverVer =04/22/2008,2.00
LayoutFile=Layout.inf
Signature="$CHICAGO$"
Class=Ports
ClassGUID={4D36E945-E325-11CE-BFC1-08002BE10318}
Provider=%Mfg%
CatalogFile.NTx86=MyINFCat.cat (newly done by me to avoid the warnings )

[Manufacturer]
%Device1% = Device1,NTamd64
%Device2% = Device2,NTamd64
%Device3% = Device3,NTamd64
%Device4% = Device4,NTamd64

[DestinationDirs]
DefaultDestDir=12

;.....................................................................................................................................................................................................................
;--------------------------------------------------------  Windows
XP/Vista/Win 7- 32 bit Architecture ---------------------------------------
;.....................................................................................................................................................................................................................

[Device1]
%MFG1% = MFG1,USB\VID_XXXX&PID_XXXX

[Device2]
%MFG2% = MFG2,USB\VID_XXXX&PID_XXXX

[Device3]
%MFG1% = MFG1,USB\VID_XXXX&PID_XXXX

[Device4]
%MFG2% = MFG2,USB\VID_XXXX&PID_XXXX

[MFG1.NT.Services]
AddService=usbser, 0x00000002, MFG1.SERVICEINST

[MFG1.SERVICEINST]
DisplayName=%MFG1%
ServiceType= 1    ;SERVICE_KERNEL_DRIVER
StartType  = 3    ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG1.NT]
CopyFiles=CopyFileSection
AddReg=RegisterAddSection

[MFG2.NT.Services]
AddService=usbser, 0x00000002, MFG2.SERVICEINST

[MFG2.SERVICEINST]
DisplayName=%MFG2%
ServiceType= 1    ;SERVICE_KERNEL_DRIVER
StartType  = 3    ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG2.NT]
CopyFiles=CopyFileSection
AddReg=RegisterAddSection

[CopyFileSection]
usbser.sys

[RegisterAddSection]  ;ADPDTM USB serial emulation
HKR,,DevLoader,,*ntkern
HKR,,NTMPDriver,,usbser.sys
HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider"

;.....................................................................................................................................................................................................................
;--------------------------------------------------------  Windows
XP/Vista/Win 7- 64 bit Architecture ---------------------------------------
;.....................................................................................................................................................................................................................

[Device1.NTamd64]
%MFG1% = MFG1.NTamd64,USB\VID_XXXX&PID_XXXX

[Device2.NTamd64]
%MFG2% = MFG2.NTamd64,USB\VID_XXXX&PID_XXXX

[Device3.NTamd64]
%MFG1% = MFG1.NTamd64,USB\VID_XXXX&PID_XXXX

[Device4.NTamd64]
%MFG2% = MFG2.NTamd64,USB\VID_XXXX&PID_XXXX

[MFG1.NTamd64.Services]
AddService=usbser, 0x00000002, MFG1.SERVICEINST.NTamd64

[MFG1.SERVICEINST.NTamd64]
DisplayName=%MFG1%
ServiceType= 1    ;SERVICE_KERNEL_DRIVER
StartType  = 3    ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys
[MFG1.NTamd64]
CopyFiles=CopyFileSection.NTamd64
AddReg=RegisterAddSection.NTamd64

[MFG2.NTamd64.Services]
AddService=usbser, 0x00000002, MFG2.SERVICEINST.NTamd64

[MFG2.SERVICEINST.NTamd64]
DisplayName=%MFG2%
ServiceType= 1    ;SERVICE_KERNEL_DRIVER
StartType  = 3    ;SERVICE_DEMAND_START
ErrorControl = 1;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\usbser.sys

[MFG2.NTamd64]
CopyFiles=CopyFileSection.NTamd64
AddReg=RegisterAddSection.NTamd64

[CopyFileSection.NTamd64]
usbser.sys

[RegisterAddSection.NTamd64]  ;ADPDTM USB serial emulation
HKR,,DevLoader,,*ntkern
HKR,,NTMPDriver,,usbser.sys
HKR,,EnumPropPages32,,"MsPorts.dll,SerialPortPropPageProvider"

;........................................................................................................................................................................................................

[Strings]
Mfg = "MYOWN"
Device3 = "FROMUS"
Device4 = "FromUK"
Device1   = "From Europe"
Device2 = "FROMAus"
MFG1 = "USB MFG1 Range"
MFG2 = "USB MFG2 Range"

Is it Kerner Model driver inf? If so, why?

3. Also , my driver installation should be a Software First Installaion or
PNP installation. To do that, i am using DPInst.exe in my Installation
Package. Its working fine but with windows signing warnings. I am intended
to avoid these warnings. I am seriously struggling here with the following
questions.
 3.1. My inf is working fine and i am using only the windows default
driver(USBSER.sys) in the inf. In this case, is it required to sign the
default sys file? Or Is it already Signed? Or Is signing not required?
 3.2.I have understood that Signing the driver binaries(SYS,DLL,...) and
Signing the driver package(inf) are completely different. Also, the signing
warning(Windows can't verify the the publisher of the software) occurs only
because of my unsigned inf and not because of the driver?Am i wrong?
 3.3 To avoid the above said warning, by assuming USESER.SYS doesn't
require any signing, i selfsigned or test signed my inf file in the
following way as mentioned at
http://www.itninja.com/question/guide-to-signing-unsigned-drivers.

# creted .cat file using Inf2cat.exe
Inf2Cat.exe /driver:"<Path of the inf>"

# created certificate using makecert.exe
MakeCert.Exe -r -pe <path to .cer file you want to generate> -n
CN=<certificate name> -sv <path to .pvk file you want to generate> -len
2048

 3.4) As per the MS DDK Documentation, the test signing or Self Signing is
done without PVK... Am i wrong in the last step?
      But here i created the PVK also?

# Create Software Publisher's Certificate (SPC) from our certificate
Cert2Spc.Exe <path to .cer file> <path to .spc file>

# Create a .pfx file
pvk2pfx.exe -pvk <path of .pvk file created earlier> -pi <password> -spc
"<path of .pfx to be stored>

# Sign the catalog file
signtool.exe sign /f "<path of .pfx file>" /p <password> /t
http://timestamp.comodoca.com/authenticode /v "<cat file to be signed>"

# Installed the certificate in local machine
certmgr.exe /add "<path of the certificate created>" /s /r localMachine root
certmgr.exe /add "<path of the certificate created>" /s /r localMachine
trustedPublishers

4. I am successuly created cert file and now, not getting any warnings
during installation with DPInst.My critical question here is, can i
distribute or publish this signed certificate that i created ?? i.e Can i
install my self signed certificate in my clients machine ( is it legal to
distribute my signed certificate for commercial use).
Please condsider that there won't be any objection from my client side
where i want to install the certificate.
Please clarify me. ( set...@gm... ). As for as my concerned, i am
self signing only the INF file and not sys file, Here i need to really
concern only about Microsoft policy on redistribution not to bother about
my clients approval?

5.Seems that certmgr.exe is not distibutable and help me in providing the
alternative tool or code to import the certificate?

With reference to your question posted in Stack overflow  dated  Sep 14,
2011, ( "Our device relies on a built-in windows driver (usbser.sys). Do we
still need to go through WHQL testing or can we install in such a way that
the user won't see a warning about not passing Logo testing? I found
http://support.microsoft.com/kb/837637 but it's not clear to me if this
will do what I want. Does it matter whether I use DPInst program or have my
own program that calls DriverPackagePreinstall?"

 I have similar  doubts and thought you might be the right person to help
me on it. kindly please reply to  set...@gm... .

  # I created a PnP driver installation package with DPInst, for USB device
with native usbser.sys driver. I created my own .inf file. The inf is
working fine in all versions of windows.

1) do i need to sign the usbser.sys though its a windows default or native
driver?? Is already signed?

2) As per my understanding, can i sign my .inf by self-signing to avoid
certification warnings??

I followed the following process to sign my inf  ( please correct me if am
wrong!! )

# creted .cat file using Inf2cat.exe
Inf2Cat.exe /driver:"<Path of the inf>"

# created certificate using makecert.exe
MakeCert.Exe -r -pe <path to .cer file you want to generate> -n
CN=<certificate name> -sv <path to .pvk file you want to generate> -len
2048

3) As per the MS DDK Documentation, the test signing or Self Signing is
done without PVK... Am i wrong in the last step?
Please refer the below link for the steps i followed:
http://www.itninja.com/question/guide-to-signing-unsigned-drivers

# Create Software Publisher's Certificate (SPC) from our certificate
Cert2Spc.Exe <path to .cer file> <path to .spc file>

# Create a .pfx file
pvk2pfx.exe -pvk <path of .pvk file created earlier> -pi <password> -spc
"<path of .pfx to be stored>

# Sign the catalog file
signtool.exe sign /f "<path of .pfx file>" /p <password> /t
http://timestamp.comodoca.com/authenticode /v "<cat file to be signed>"

# Installed the certificate in local machine
certmgr.exe /add "<path of the certificate created>" /s /r localMachine root
certmgr.exe /add "<path of the certificate created>" /s /r localMachine
trustedPublishers

using above steps i creted the certificate and now while installing the
package there is no " certificate warning ".

4) my doubt at this point is, can i distribute or publish this signed
certificate?? i.e Can i install my self signed certificate in my clients
machine ( is it legal to distribute my signed certificate for commercial
use). Please condsider that there won't be any objection from clients side
where i want to install the certificate.
Please clarify me. ( set...@gm... ). As for as my concerned, i am
self signing only the INF file and not sys file, so i am allowed to
resdistribue? Kindly provide me the MS Links for reference.

Thanks in advance.

Sethu

[libwdi-devel] signing my INF file?

Windows Driver Installer library for USB devices

[libwdi-devel] signing my INF file?