How to deploy a file system driver?

Question

I was trying to test this File System Minifilter Driver sample. I'm having a problem with the deployment because this is not an actual device driver (non-PnP driver).

In Visual Studio, in the property page of the project: Driver Install -> Deployment, If I select "Hardware ID Update", I don't know what is the hardware ID for the driver and I cannot see in the .INF file either.

If I select "Install/Reinstall and Verify" -> "Default Driver Package Installation Task (possible reboot)", I get Driver Deployment Task Failed: Default Driver Package Installation Task error.

Deployment settings in VS

I checked this and this page but I couldn't find anything beside how to prepare the .INF file.

How can I deploy this driver to my target machine? Thank you.

xord xord · Accepted Answer · 2020-07-19T21:12:33

Actually you don't need an INF file to install your mini filter driver.

First, create a kernel driver service with either "sc create" from command line or call "CreateService" from your installation program if you want to automate the deployment.

Then, add some registry modification as below (from Norton 360) with Registry Editor or again with Win32 registry APIs in your installation program:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SymEFASI\Instances]
"DefaultInstance"="SymEFASI"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SymEFASI\Instances\SymEFASI]
"Flags"=dword:00000000
"Altitude"="260610"

Replace "SymEFASI" with your driver service name when running "sc create" or calling "CreateService". The most important part is "Altitude". It needs to be unique in your system, otherwise Filter Manager won't load your driver due to conflicts. For a formal product deployed in the real world to end-users, you need to apply for a unique number assigned by Microsoft. This is also critical because mini filter drivers are classified by layers. Each layer has its own functionalities. If your driver sits on the wrong layer, you might not see the correct data or behavior as you want.

Once the above is done, the last thing is to run "sc start" or call "StartService".

How to deploy a file system driver?

1 Answers