A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #18501  by Stylo
 Tue Mar 12, 2013 8:10 pm
I never tried it b4, only read some places that it have to be signed by microsoft or something..
Also read that i can set my computer booting on test mode ?! that i can load unsigned drivers.

can any of you explain a bit more about that?
Thanks
 #19211  by Stylo
 Tue May 07, 2013 8:10 pm
I set the TESTSIGNING on and yet when i'm trying to load a simple driver a message pops out saying an unsigned driver is loaded and block it right away...
Is there a way to sign the driver ?
So far i coded drivers for windows xp only
 #19212  by Stylo
 Tue May 07, 2013 8:16 pm
One more thing..
I'm trying to use signtool.exe to sign my driver right after i compile it.
now the message doesn't pop but there is no output in the dbgView window.. (and yes "capture kernel" is checked)
 #19228  by Stylo
 Wed May 08, 2013 7:01 pm
I'm using Windows 7 x64.
And thanks that worked (i just googled for enabling debug print) :)

** Edit **
I have no idea what i have done wrong
but i got BSOD and from now on i can load the driver but i cannot see any debug print again..
I checked the value at the registry and it's still fine..

any ideas?
 #19234  by EP_X0FF
 Thu May 09, 2013 12:56 am
Hello,

what BSOD do you have? Are you sure your driver loads?
 #19238  by Stylo
 Thu May 09, 2013 5:46 am
I can't remember, I haven't looked at the error message.
but i restarted my machine and it fixed it...
One more thing, is the loading process different on windows server 2008 R2 ?
because i set TESTSIGNING on and change the registry value
and still i can't load the driver INSTDRV.exe says an unexpected error occured when i start the driver
 #19239  by EP_X0FF
 Thu May 09, 2013 6:25 am
There should be no difference between 7 and 2008 R2 as they are build on the same kernel. However server may have enabled by default policy to restrict installation of unsigned drivers. Have you tried manual load via SCM/NtLoadDriver, what is the status, error code? Also is INSTDRV 32bit? Never tried it on x64, is it compatible with x64 (wow64 registry redirection)?
 #19240  by Stylo
 Thu May 09, 2013 7:08 am
I haven't tried loading it manually using SCM/NtLoadDriver
And i believe INSTDRV is working for x64 system as well since in Win 7 it did load the driver properly.
I used SignTool.exe to sign my driver (on windows 7) and only when i signed it could load it
i tried that too on win server 2008 r2 but signtool returned with an error