WinUsb and WHQL signing
Guld@discussions.microsoft.com Morten Guld
found new hardware wizard or do you trust company X) when the user plugs in
the usb device. The driver basicly consist of a INF file which associates our
device with the WinUsb driver.
In order to be able to fullfill our requirements we understand that we need
to go through the Windows Logo Program and get a WHQL signature for the
driver (- this is a bit odd because the WinUsb driver is already WHQL
signed). Is this correct or is there another way to get arround this?
We do not require a Windows Logo on our usb devices. We just want to get rid
of any user interaction during installation. We quess that what we need is
the Unclassified Signature Program
(http://msdn.microsoft.com/en-us/library/dd424561.aspx).
We will have to support Windows XP, Vista and Windows 7 (all 32 bit
versions). What efford should we expect to pass the DTM tests?
Can we perform the test on a single PC or do we need a larger test setup? If
a test fails do we then need to rerun the entire test or only the one that
failed.
/Morten
David Craig
submissions. 64-bit is REQUIRED. A lot of effort until you understand how
it just works.
"Morten Guld" <Morten Gu...@discussions.microsoft.com> wrote in message
news:C1F198F9-0B49-4A73...@microsoft.com...
Hannes
A couple of comments from our experience:
The VID/PID for your device, or a USB class name, will decide what driver
will be loaded. If a matching driver is not shipped in-box with Windows
(XP/Vista/7) then you need to provide it on some sort of media (some clever
devices actually present themselves as a standard CD-ROM in order to
automatically load and launch driver installation files located on them). If
drivers are not found then your installation can of course not be silent.
To avoid "Do you trust..." etc popups, your drivers need to be WHQL tested
and signed. This is true also if you write your own INF that utilizes an
in-box .sys file. The in-box file may be signed already, but it has not been
tested against your particular hardware, which is why you need to run WHQL
tests to get signature.
Select the WHQL tests tht are the closest mach to your device. If you find
no matching device class, then use the Unclassified test suite.
I think you need to execute WHQL test suites on every OS you want log for,
i.e.
XP-32, XP-64, Vista-32, Vista-64, Win7-2, Win7-64 - so 6 test suites in all.
If you want to install these OSes on only one PC, that is possible but may
also take a long time. You can save time by using 6 separate machines.
Hope this helps,
/ Hannes.
Denis @ TheOffice
I had a hard time because of miss lead like this.
64 Bit Vista/7
The Logo certification is not mandatory in order to load a USB driver.
In order to load the package must be signed with a KMCS signature.
The KMCS signature is made based on a certification purchased from an authorized CA vendor,
and a Cross Certificate obtain found at:
http://www.microsoft.com/whdc/winlogo/drvsign/crosscert.mspx
Must also use the signtool provided in the latest WDK (such as WDK 7600.16385.0)
Another thing you can only sign with the computer that the CA certificate was issued.
This example is with a VeriSign spc.
SignTool sign /v /ac C:\VeriSign\MSCV-VSClass3.cer /s my /n "YOUR CORPORATION REGISTERD TO CA" /t
http://timestamp.verisign.com/scripts/timestamp.dll YourUsb.sys
to verify : Signtool verify /kp /v yourusb.sys
Then generate a cat file for your inf:
Inf2Cat /driver:. /os:2000,XP_X86,XP_X64,Server2003_X86,Server2003_X64,Server2003_IA64,Vista_X86,Vista_X64 /v
SignTool sign /v /ac C:\VeriSign\MSCV-VSClass3.cer /s my /n "YOUR CORPORATION REGISTERD TO CA" /t
http://timestamp.verisign.com/scripts/timestamp.dll YourCat.cat
to verify : Signtool verify /kp /v /c yourusb.cat yourusb.sys
That is all that is needed.
Denis
p.s. Reinstalling a driver is a different issue.
"Hannes" <hanne...@newsgroup.nospam> wrote in message news:5C215B59-F991-467F...@microsoft.com...
![Mike [MSFT]'s profile photo](http://lh3.googleusercontent.com/a-/ALV-UjX888Dh7xHKQy4hUAVyzCOvIXyxAck_C75e8ISRcRJHUn1vVg=s40-c)
Mike [MSFT]
prompt when staging the driver to the system on Vista and Win 7. This is
because the certificate would not yet be installed (trusted) on the machine.
Though that would be a 1-time prompt that users would not see when plugging
in devices that match that driver.
On XP however a WHQL signature is required to avoid a "do you trust" prompt
when the user plugs in a device that matches the driver.
http://msdn.microsoft.com/en-us/library/aa906343.aspx
-Mike
"Denis @ TheOffice" <den...@ica.net> wrote in message
news:Of8Iu2XY...@TK2MSFTNGP02.phx.gbl...
Morten Guld
> If you don't get a WHQL signature then you will still get a "do you trust"
> prompt when staging the driver to the system on Vista and Win 7. This is
> because the certificate would not yet be installed (trusted) on the machine.
> Though that would be a 1-time prompt that users would not see when plugging
> in devices that match that driver.
It is okay that the user has to accept our certificate. Is there a way to
suppress the warning until the user plugs in the USB device? The message
would break our unattended install.
Morten Guld
> Read the WHQL web site. Follow the instructions there. Forget 32-bit only
> submissions. 64-bit is REQUIRED. A lot of effort until you understand how
> it just works.
As we understand it, 64-bit is only a requirement for Vista and Windows 7?
/Morten
David Craig
even 2k, but most if not all submissions must have Vista and probably soon
Win7.
"Morten Guld" <Morte...@discussions.microsoft.com> wrote in message
news:A9097472-A0AC-4A57...@microsoft.com...
Mike [MSFT]
all your users' machines then that will avoid the prompt.
-Mike
"Morten Guld" <Morte...@discussions.microsoft.com> wrote in message
news:6BCBA434-DA57-490A...@microsoft.com...