signed catalog when using WinUSB.dll

We are starting to switch to Microsoft's WinUSB.sys device driver for
some of our USB devices. We access the driver thru WinUSB.dll . To get our
driver 'signed' so that the user does not see any warnings on Vista and
Windows 7 when the USB device is plugged in, it looks like we have to submit
a driver package to WHQL in order to get a signed catalog file back from
Microsoft.

Our .inf file contains our USB vid/pid and refers to WinUSB.sys .
So...apparently, we need to submit a driver package with .inf and .cat files
and test logs for our device to WHQL even though WinUSB.sys came from
Microsoft.

Is my understanding of the situation correct?

correct, you need to get the INF, CAT and all of the coinstaller DLLs
submitted as a packge so you can get them signed

d

--

This posting is provided "AS IS" with no warranties, and confers no rights.


"Elliot" <> wrote in message
news8F6FA59-7633-4519-84FB-...
> We are starting to switch to Microsoft's WinUSB.sys device driver for
> some of our USB devices. We access the driver thru WinUSB.dll . To get our
> driver 'signed' so that the user does not see any warnings on Vista and
> Windows 7 when the USB device is plugged in, it looks like we have to
> submit
> a driver package to WHQL in order to get a signed catalog file back from
> Microsoft.
>
> Our .inf file contains our USB vid/pid and refers to WinUSB.sys .
> So...apparently, we need to submit a driver package with .inf and .cat
> files
> and test logs for our device to WHQL even though WinUSB.sys came from
> Microsoft.
>
> Is my understanding of the situation correct?

Hi,

"Doron Holan [MSFT]" <> wrote in message
news:%...
> correct, you need to get the INF, CAT and all of the coinstaller DLLs
> submitted as a packge so you can get them signed
>
I don't think you have to get the package signed by WHQL, because as you
state, WinUSB is already signed. All you need is a certificate from a CA
from the shortlist (that have a cross certificate from Microsoft). We got
one from GlobalSign.
With the tools from the WDK, you can then generate a .cat file from your
..inf file, and sign it yourself. Add that to your package and that should be
enough. We did it that way.

Regards, Matt

"mpv" <> wrote:
>>
>I don't think you have to get the package signed by WHQL, because as you
>state, WinUSB is already signed. All you need is a certificate from a CA
>from the shortlist (that have a cross certificate from Microsoft). We got
>one from GlobalSign.
>With the tools from the WDK, you can then generate a .cat file from your
>.inf file, and sign it yourself. Add that to your package and that should be
>enough. We did it that way.

Well, it depends on what you need. You don't need to sign the driver for
KMCS purposes, because it's already signed. But if you want to avoid the
"unsigned driver" warning at install time, then you need to get the driver
PACKAGE signed by WHQL.
--
Tim Roberts,
Providenza & Boekelheide, Inc.

Hi,

"Tim Roberts" <> wrote in message
news:...
> Well, it depends on what you need. You don't need to sign the driver for
> KMCS purposes, because it's already signed. But if you want to avoid the
> "unsigned driver" warning at install time, then you need to get the driver
> PACKAGE signed by WHQL.

In this specific case (already signed WinUSB), I don't think so, and I am
speaking from experience.
We use a Wise script, together with the WinUSB co-installers, DPInst.exe
(which also has a 64 bit version), and the .inf file with corresponding
signed .cat file. That is enough. On installing the package on Vista 64 or
W7 64, we do not get a warning, just a dialog whether you want to trust our
company in future.
We have never had any business with WHQL.
(You yourself helped me find a bug in the MS example WinUSB .inf file, for
which I am still grateful.)

Regards, Matt

"mpv" <> wrote:
>
>In this specific case (already signed WinUSB), I don't think so, and I am
>speaking from experience.
>We use a Wise script, together with the WinUSB co-installers, DPInst.exe
>(which also has a 64 bit version), and the .inf file with corresponding
>signed .cat file. That is enough. On installing the package on Vista 64 or
>W7 64, we do not get a warning, just a dialog whether you want to trust our
>company in future.

Yes, that's the one. If the package is WHQL signed, there's no dialog at
all -- the driver installs silently.

As I said, it depends on what you need. Or, more accurately, what your
marketing department demands...
--
Tim Roberts,
Providenza & Boekelheide, Inc.

Hi,

"Tim Roberts" <> wrote in message
news:...
>
> Yes, that's the one. If the package is WHQL signed, there's no dialog at
> all -- the driver installs silently.
>
> As I said, it depends on what you need. Or, more accurately, what your
> marketing department demands...
> --
I think there is a huge difference between a BIG RED warning, that advises
you NOT to install this driver, and a dialog that asks whether you want to
trust this company also in future (meaning the company's certificate is
added to a trusted category in the certificate store).
I don't know what else could happen with cross certificates. Surely this is
the procedure that was meant by Microsoft when they provided these cross
certificates?

Regards, Matt

Hi all,

i have a problem just like that.
I have written an RNDIS usb device driver for our hardware and use the standard (signed) rndis windows drivers together with an INF file that contains our VID/PID. It works fine except the $%&§ INF driver installation process.

Is such a cross certificate solution also usable for Windows XP.
Can i then preinstall my "cross certificied" INF file, so that Windows XP does not come up with the "Found New Hardware Wizard" when the hardware gets inserted and installs the driver silently (like Windows 7 does)

Can anyone tell me what is approximately the cost for a full WHQL signing.

Besides i never thougth that it would be such a mess to make our hardware smoothly running under windows with drivers originated from microsoft itself... I have never read such a couple of different meanings and tips as on this "driver signing" stuff.

Regards, Martin

"mpv" <> wrote:
>
>I think there is a huge difference between a BIG RED warning, that advises
>you NOT to install this driver, and a dialog that asks whether you want to
>trust this company also in future (meaning the company's certificate is
>added to a trusted category in the certificate store).
>I don't know what else could happen with cross certificates. Surely this is
>the procedure that was meant by Microsoft when they provided these cross
>certificates?

The cross certificates are used for KMCS, not for package signing. A
64-bit driver will not load at all unless it's signed with a code-signing
certificate and the appropriate cross certificate.
--
Tim Roberts,
Providenza & Boekelheide, Inc.

"mpv" wrote:

> In this specific case (already signed WinUSB), I don't think so, and I am
> speaking from experience.
> We use a Wise script, together with the WinUSB co-installers, DPInst.exe
> (which also has a 64 bit version), and the .inf file with corresponding
> signed .cat file. That is enough. On installing the package on Vista 64 or
> W7 64, we do not get a warning, just a dialog whether you want to trust our
> company in future.

Matt, I've been lurking for a while reading your posts and I must say I
think you have the best handle on this situation than anyone else. Bravo.
I'm trying to figure out how to do an automatic install of the driver before
the user plugs the device in, you mentioned using a WISE script, is there any
way you could share that or how it works? Or could you or someone else give
me some direction on how I can pre-install the driver before the device gets
plugged in? I'd be happy to pay you or anyone for their help. Post back or
email please.