1

I'm trying to get the minispy minifilter from Microsoft to install and function properly. I started a new empty kernel driver project in VS2013, and compiled the driver and test signed it.

I can use the wdreg.exe utility to successfully install the driver, and I put a DbgPrint test in the beginning of the DriverEntry() function and I can read it using DbgView so the driver appears to install ok. Also using wdreg.exe to install the driver creates a Wdf01000 named service and using sc query Wdf01000 I can view it running. Using fltmc.exe to load or view the instances gives odd results.

Microsoft says that to install it I should right click the .inf file and click install, and when I do this Windows tells me "The .inf file you have selected does not support this method of installation". Pasted is a copy of my .inf file generated by VS2013.

Can someone tell me the correct way to install the minispy driver, start the minispy driver and attach it to a filesystem on x64 Win7/Win8? Thanks

[Version]
Signature="$WINDOWS NT$"
Class=Sample ; TODO: edit Class
ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid
Provider=%ManufacturerName%
CatalogFile=MiniSpyDev.cat  
DriverVer= ; TODO: set DriverVer in stampinf property pages

[DestinationDirs]
DefaultDestDir = 12

; ================= Class section =====================

[ClassInstall32]
Addreg=SampleClassReg

[SampleClassReg]
HKR,,,0,%ClassName%
HKR,,Icon,,-5

[SourceDisksNames]
1 = %DiskName%,,,""

[SourceDisksFiles]
MiniSpyDev.sys  = 1,,

;*****************************************
; Install Section
;*****************************************

[Manufacturer]
%ManufacturerName%=Standard,NT$ARCH$

[Standard.NT$ARCH$]
%MiniSpyDev.DeviceDesc%=MiniSpyDev_Device, Root\MiniSpyDev ; TODO: edit hw-id

[MiniSpyDev_Device.NT]
CopyFiles=Drivers_Dir

[Drivers_Dir]
MiniSpyDev.sys

;-------------- Service installation
[MiniSpyDev_Device.NT.Services]
AddService = MiniSpyDev,%SPSVCINST_ASSOCSERVICE%, MiniSpyDev_Service_Inst

; -------------- MiniSpyDev driver install sections
[MiniSpyDev_Service_Inst]
DisplayName    = %MiniSpyDev.SVCDESC%
ServiceType    = 2               ; SERVICE_KERNEL_DRIVER
StartType      = 0               ; 
ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
ServiceBinary  = %12%\MiniSpyDev.sys
LoadOrderGroup = Extended Base

;
;--- MiniSpyDev_Device Coinstaller installation ------
;

[DestinationDirs]
MiniSpyDev_Device_CoInstaller_CopyFiles = 11

[MiniSpyDev_Device.NT.CoInstallers]
AddReg=MiniSpyDev_Device_CoInstaller_AddReg 
CopyFiles=MiniSpyDev_Device_CoInstaller_CopyFiles

[MiniSpyDev_Device_CoInstaller_AddReg]
HKR,,CoInstallers32,0x00010000,     "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller"

[MiniSpyDev_Device_CoInstaller_CopyFiles]
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll

[SourceDisksFiles]
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with               SourceDisksNames

[MiniSpyDev_Device.NT.Wdf]
KmdfService =  MiniSpyDev, MiniSpyDev_wdfsect
[MiniSpyDev_wdfsect]
KmdfLibraryVersion = $KMDFVERSION$

[Strings]
SPSVCINST_ASSOCSERVICE= 0x00000002
ManufacturerName="" ; TODO: add ManufacturerName
ClassName="Samples" ; TODO: edit ClassName
DiskName = "MiniSpyDev Installation Disk"
MiniSpyDev.DeviceDesc = "MiniSpyDev Device"
MiniSpyDev.SVCDESC = "MiniSpyDev Service"

migrated from stackoverflow.com Mar 25 '14 at 23:12

This question came from our site for professional and enthusiast programmers.

  • 1
    You might want to flag this and ask a mod to migrate it to Super User for you. SO is geared toward questions about code. – Caleb Mar 3 '14 at 18:14
  • Thanks for trying Caleb, but that doesn't help and there's a lot of code involved in this question. – user3375969 Mar 3 '14 at 18:22
  • Here's another similar (but different) question the mods felt appropriate stackoverflow.com/questions/19779530/…. You should let the mods make that decision in the future and try to only post in topics you know about.... – user3375969 Mar 3 '14 at 18:30
  • I see that you're new here, so you may not realize that it's the StackOverflow community, not moderators, that makes most decisions about what is/isn't on topic. To me, your question appears to be off topic because it relates to installing an existing piece of software and it isn't about a problem with code that you're writing; also, the "code" you included appears to be a configuration file. I certainly didn't mean to offend you by suggesting that you have your question moved -- I was only trying to help you find a place for it where the community wouldn't end up voting to close. Good luck. – Caleb Mar 3 '14 at 19:29
  • The community isn't voting to close it here either, and once again that's for the community to decide and not u. This definitely has a lot to do with code and most likely requires a programmer to answer it. There were many changes that needed to be made to the .inf file to get it to work with the minifilter code, that's the short version of the answer, but thank u for the input. – user3375969 Mar 3 '14 at 22:40
0

You need to create a .cat file based on the inf and then sign the .cat. There is a tool called inf2cat that creates the cat then just use signtool to sign it. Once done, it should install no problem.

0

So you have your driver running, great. The Minispy FSFD sample is comprised of two parts, though.

But let's backtrack a little. Theat INF does not contain a DefaultInstall or DefaultInstall.Services section - a prerequisite to using the method you attempted (Right-click + "Install").

You can see what command gets executed by looking at HKCR\inffile\shell\Install\command (%SystemRoot%\System32\InfDefaultInstall.exe "%1" in my case). This, effectively uses setupapi.dll (InstallHinfSection) to attempt the installation. The same can be achieved using rundll32.exe according to this article.

Guessing by where the sample comes from (the WDK), I'd probably attempt installing via dpinst.exe which comes inside the redist\DIFx\dpinst folder of the Windows 7 SP1 WDK, for example. But since you already managed to install the driver, this doesn't seem to be the issue. The driver is evidently running.

Anyway, you need to understand that just because you see debug output from DriverEntry() doesn't mean that the filter driver is attached to any volumes. In fact the documentation for Minispy explicitly states that you need a user mode utility (doesn't state anything about a Windows service, though). And when I look at the sample code I would expect to get the mini-FSFD named minispy.sys and a console application named minispy.exe from a build. The latter is supposed to control the former, including control of attaching to volumes (consult InterpretCommand() inside mspyUser.c for details). For example the command a for attach, d for detach and l for listing devices (volumes).


I don't know why you used wdreg.exe, but the result looks as if it installed some user-mode driver (WDF/WUDF)?! This is a kernel mode driver, though, so it's natural for this not to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy