Unexepcted behavior uninstalling Primitive Driver

Question

question

n4r1B-3693 asked Apr 22, '22 PavelVarabei-7049 commented Jun 23, '22

Unexepcted behavior uninstalling Primitive Driver

I'm just testing how Primitive Drivers work by creating a FiDO that will attach to multiple stacks, since the driver is not tied to any hardware I believe this is the ideal situation to use a Primitive Driver. I'm using the following INF file:

 [Version]
 Signature="$WINDOWS NT$"
 Class=TestPrimitiveDriver
 ClassGuid={2388B6BD-B83D-4FDE-A6B7-7A06E124CA50}
 Provider=%ManufacturerName%
 DriverVer=
 CatalogFile=TestPrimitiveDriver.cat
 PnpLockdown=1
    
 [DestinationDirs]
 DefaultDestDir = 13
    
 [SourceDisksNames]
 1 = %DiskName%,,,""
    
 [SourceDisksFiles]
 TestPrimitiveDriver.sys = 1,,
    
 [DefaultInstall.NTamd64]
 CopyFiles = MyCopyFiles
 AddReg = MyAddReg
    
 [MyCopyFiles]
 TestPrimitiveDriver.sys
    
 [MyAddReg]
 HKLM, System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}, UpperFilters, 0x00010008, PrimitiveDriverSvc ;disk
 HKLM, System\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}, UpperFilters, 0x00010008, PrimitiveDriverSvc ;cd-rom
    
 [DefaultInstall.NTamd64.Services]
 AddService = PrimitiveDriverSvc,, MyService_Install
    
 [MyService_Install]
 DisplayName    = PrimitiveDriverSvc
 ServiceType    = 1               ; SERVICE_KERNEL_DRIVER
 StartType      = 0               ; SERVICE_BOOT_START
 ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
 ServiceBinary  = %13%\TestPrimitiveDriver.sys
 LoadOrderGroup = "PnP Filter"

To install I don't have any problem using DiInstallDriver, the driver gets copied to the DriverStore and the RegKeys and Service are created correctly.
Unfortunately, running DiUninstallDriver is not working as expected since the RegKeys and the Service are not being removed but the driver is actually being removed from the DriverStore. Looking at the SetupAPI log is even more surreal, this is the output of the uninstall command -- Logging most verbose for General and Device:

 >>>  [Driver Uninstall (DiUninstallDriver) - .\TestPrimitiveDriver\TestPrimitiveDriver.inf]
 >>>  Section start 2022/04/22 11:48:02.448
       cmd: "C:\Users\n4r1B\Desktop\TestPrimitiveDriverInstaller.exe" uninstall .\TestPrimitiveDriver\TestPrimitiveDriver.inf
      ndv: Flags: 0x00000000
      ndv: INF path: C:\Users\n4r1B\Desktop\TestPrimitiveDriver\TestPrimitiveDriver.inf
      dvs: {DrvSetupUninstallDriver - C:\Users\n4r1B\Desktop\TestPrimitiveDriver\TestPrimitiveDriver.inf}
      dvs:      Flags: 0x00000000
      dvs:      {Driver Setup Delete Driver Package: oem2.inf} 11:48:02.465
      utl:           INF 'oem2.inf' is removable.
      utl:           Driver package is allowed to be unconfigured.
      ump:           Delete flags: 0x00000002
      ump:           Creating process: DrvInst.exe 11:48:02.495
      pol:           {Driver package policy check} 11:48:02.500
      pol:           {Driver package policy check - exit(0x00000000)} 11:48:02.501
      sto:           {Unstage Driver Package: C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf} 11:48:02.501
      sto:                {Core Driver Package Delete: testprimitivedriver.inf_amd64_6de13b8e0803e593} 11:48:02.502
      sto:                     {DRIVERSTORE DELETE BEGIN} 11:48:02.503
      inf:                          Opened INF: 'C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf' ([strings])
      sto:                     {DRIVERSTORE DELETE BEGIN: exit(0x00000000)} 11:48:02.504
      sto:                     {Unconfigure Driver Package: C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf}
      sto:                          Driver Package = testprimitivedriver.inf_amd64_6de13b8e0803e593
      sto:                          Flags          = 0x00000002
      inf:                          Opened INF: 'C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf' ([strings])
 !    sto:                          Device class {2388b6bd-b83d-4fde-a6b7-7a06e124ca50} does not exist. Error = 0x00000002
      inf:                          Class GUID     = {2388b6bd-b83d-4fde-a6b7-7a06e124ca50}
      inf:                          Opened INF: 'C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf' ([strings])
      idb:                          Active configurations for 'oem2.inf':
      idb:                               DefaultInstall.NTamd64
      inf:                          Schema extension {2388b6bd-b83d-4fde-a6b7-7a06e124ca50} not found.
      inf:                          {Unconfigure Driver: DefaultInstall.NTamd64}
      inf:                               Manufacturer = n4r1b
      inf:                               Section Name = DefaultInstall.NTamd64
      inf:                               Driver Type  = Primitive
      sto:                               Finding all driver package versions:
      sto:                                    testprimitivedriver.inf_amd64_6de13b8e0803e593 [oem2.inf] - 04/22/2022,20.42.17.709 (Active)
 !    inf:                               Driver configures class filter [UpperFilters] for {4d36e967-e325-11ce-bfc1-08002be10318} device class.
 !    sto:                               Skipping driver unconfiguration to preserve existing class filters.
      inf:                               {Add Service: PrimitiveDriverSvc}
 !    inf:                                    Could not reference service 'PrimitiveDriverSvc' against last owner. Error = 0x00000002
      inf:                               {Add Service: exit(0x00000000)}
      inf:                               AddReg: HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\UpperFilters
      inf:                               Registry key 'HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\UpperFilters' remains with owner '!testprimitivedriver.inf_amd64_6de13b8e0803e593'.
      inf:                               Registry key 'HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\UpperFilters' still in use by 2 sources.
      inf:                               AddReg: HKLM\System\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\UpperFilters
      inf:                               Registry key 'HKLM\System\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\UpperFilters' remains with owner '!testprimitivedriver.inf_amd64_6de13b8e0803e593'.
      inf:                               Registry key 'HKLM\System\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\UpperFilters' still in use by 1 source.
      cpy:                               Skipping isolated file 'TestPrimitiveDriver.sys'.
      sto:                               Installing primitive driver 'testprimitivedriver.inf_amd64_6de13b8e0803e593'.
      sto:                               {Configure Driver Package: C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf}
      sto:                                    Driver Package = testprimitivedriver.inf_amd64_6de13b8e0803e593
      sto:                                    Flags          = 0x80000000
      inf:                                    Opened INF: 'C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf' ([strings])
 !    sto:                                    Device class {2388b6bd-b83d-4fde-a6b7-7a06e124ca50} does not exist. Error = 0x00000002
      inf:                                    Class GUID     = {2388b6bd-b83d-4fde-a6b7-7a06e124ca50}
      inf:                                    Opened INF: 'C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf' ([strings])
      idb:                                    Active configurations for 'oem2.inf':
      idb:                                         DefaultInstall.NTamd64
      inf:                                    {Configure Driver: DefaultInstall.NTamd64}
      inf:                                         Manufacturer = n4r1b
      inf:                                         Section Name = DefaultInstall.NTamd64
      inf:                                         Driver Type  = Primitive
      inf:                                         {Add Service: PrimitiveDriverSvc}
      inf:                                              Start Type    = 0
      inf:                                              Service Type  = 1
      inf:                                              Error Control = 1
      inf:                                              Image Path    = System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\TestPrimitiveDriver.sys
      inf:                                              Display Name  = PrimitiveDriverSvc
      inf:                                              Group         = PnP Filter
      inf:                                              Created new service 'PrimitiveDriverSvc'.
      inf:                                         {Add Service: exit(0x00000000)}
      inf:                                         AddReg: HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\UpperFilters
      inf:                                         AddReg: HKLM\System\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\UpperFilters
      cpy:                                         Skipping isolated file 'TestPrimitiveDriver.sys'.
      inf:                                    {Configure Driver: exit(0x00000000)}
      flq:                                    {FILE_QUEUE_COMMIT} 11:48:02.537
      flq:                                         No operations queued.
      flq:                                    {FILE_QUEUE_COMMIT - exit(0x00000000)} 11:48:02.538
      sto:                                    Configured driver package. Time = 16 ms
      sto:                               {Configure Driver Package: exit(0x00000000)}
      inf:                          {Unconfigure Driver: exit(0x00000000)}
      flq:                          {FILE_QUEUE_COMMIT} 11:48:02.540
      flq:                               No operations queued.
      flq:                          {FILE_QUEUE_COMMIT - exit(0x00000000)} 11:48:02.541
      idb:                          Cleared active configurations for 'oem2.inf'.
      sto:                          Unconfigured driver package. Time = 47 ms
      sto:                     {Unconfigure Driver Package: exit(0x00000000)}
      idb:                     {Unpublish Driver Package: C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf} 11:48:02.543
      idb:                          Opened driver package object 'testprimitivedriver.inf_amd64_6de13b8e0803e593' in DRIVERS database node.
      idb:                          Opened driver INF file object 'oem2.inf' in DRIVERS database node.
      idb:                          Clearing active driver package 'testprimitivedriver.inf_amd64_6de13b8e0803e593'.
      cpy:                          Unpublished 'oem2.inf'.
      inf:                          Opened INF: 'C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf' ([strings])
      idb:                          Deindexed 1 device ID for 'testprimitivedriver.inf_amd64_6de13b8e0803e593'.
      sto:                          Flushed driver database node 'DRIVERS'. Time = 15 ms
      sto:                          Flushed driver database node 'SYSTEM'. Time = 0 ms
      idb:                     {Unpublish Driver Package: exit(0x00000000)} 11:48:02.567
      idb:                     {Unregister Driver Package: C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593\testprimitivedriver.inf} 11:48:02.568
      idb:                          Unregistering driver package object 'testprimitivedriver.inf_amd64_6de13b8e0803e593' from DRIVERS database node.
      idb:                          Driver package 'testprimitivedriver.inf_amd64_6de13b8e0803e593' is registered to 'oem2.inf'.
      idb:                          Unregistered driver package 'testprimitivedriver.inf_amd64_6de13b8e0803e593' from 'oem2.inf'.
      idb:                          Deleted driver package object 'testprimitivedriver.inf_amd64_6de13b8e0803e593' from DRIVERS database node.
      idb:                          Deleted driver INF file object 'oem2.inf' from DRIVERS database node.
      idb:                     {Unregister Driver Package: exit(0x00000000)} 11:48:02.572
      cpy:                     {Delete Directory: C:\Windows\System32\DriverStore\FileRepository\testprimitivedriver.inf_amd64_6de13b8e0803e593} 11:48:02.572
      cpy:                     {Delete Directory: exit(0x00000000)} 11:48:02.573
      sto:                     {DRIVERSTORE DELETE END} 11:48:02.574
      sig:                          Uninstalled catalog 'oem2.cat'.
      sto:                     {DRIVERSTORE DELETE END: exit(0x00000000)} 11:48:02.580
      sto:                {Core Driver Package Delete: exit(0x00000000)} 11:48:02.580
      sto:           {Unstage Driver Package: exit(0x00000000)} 11:48:02.603
      ump:           Driver store delete process exited with code 0x00000000 11:48:02.607
      dvs:      {Driver Setup Delete Driver Package - exit (0x00000000)} 11:48:02.615
      dvs: {DrvSetupUninstallDriver - exit(00000000)}
 <<<  Section end 2022/04/22 11:48:02.635
 <<<  [Exit status: SUCCESS]

Looking at that not only it doesn't uninstall but it actually executed the DefaultInstall again, I double checked this by deleting the Service and RegKeys and execute DiUninstallDriver and to my surprise the Service/RegKeys were installed.

Am I doing something wrong in the INF, or is there an issue with the uninstall process of Primitive Drivers?

windows-hardware windows-hardware-wdk

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

n4r1B-3693 · Apr 22 at 07:24 PM

Just to add more info, I'm running on Win 11 Version 21h2 (OS build 22000.434) and the version for drvsetup.dll is 10.0.22000.1 and for drvstore.dll 10.0.22000.120

Also, checking on a decompiler drvsetup.dll seems to be setting the Arch to 0xFFFF in the UpdateInfo, if this value is 0xFFFF then the _INF_PARSE_CONTEXT->Field10 in drvstore.dll will be left as zero.

This value is afterwards checked to be non-zero when drvsetup.dll calls DrvUtilsIsValidPrimitiveDriver . The value is checked inside drvstore.dll DriverPackageQueryPrimitiveStatus for DEVPKEY_DriverPackage_Primitive

Finally, the fact that the INF is not validated as a Primitive Driver means that UninstallPrimitiveDriversEnumCallback will never get called. I'm not sure if this might be the problem but it's definitely something to check :)

0 ·

Answer 1 · 2022-04-25T18:47:00.073Z

ZacLockard answered Apr 25, '22 n4r1B-3693 commented May 2, '22

Hi -

This is a by-design behavior for compat reasons. For class filters registered in a legacy manner (i.e. using a registry key), we can't determine if your primitive driver is what created that service/filter or if it previously existed and removing it with your primitive driver will break something else. We have a new filter registration mechanism that does not have this problem though, and if you use it in this INF you will see the behavior you're looking for. The actual syntax docs aren't quite up yet, but we do have this guidance page on the new mechanism: Device Driver Filter Ordering

One thing I want to note is that the new filter mechanism only alters the filters of the class the INF belongs to, so this INF would either be in the disk or cd-rom classes and you'd have a second INF for the other class. But what you'll want to do is remove the reference to MyAddReg, and replace it with this:

 [DefaultInstall.NTamd64.Filters]
 AddFilter = PrimitiveDriverSvc,,Filter_Install
    
 [Filter_Install]
 FilterPosition = Upper

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

n4r1B-3693 · Apr 27 at 03:22 PM

I still don't see the RegKey and the service being removed when calling DiUninstallDriver. Just to be sure, is the PrimitiveDriver approach still the way to go for this case or should I use a normal inf with a DefaultUninstall section?

Regarding using multiple INFs, can we achieve this by using something like multiple Extension INFs or each class should have it's own independent INF?

0 ·

ZacLockard n4r1B-3693 · Apr 27 at 06:18 PM

You can't set the reg key if you're using AddFilters, it's an entirely separate mechanism and you won't see a regkey set when using it. Primitive drivers are the way to go for class filters, and each class should be its own independent INF to use primitive.

1 ·

n4r1B-3693 · May 02 at 05:23 PM

Sorry to bother again, but I changed my INF to the following:

 [Version]
 Signature="$WINDOWS NT$"
 Class=DiskDrive
 ClassGuid={4d36e967-e325-11ce-bfc1-08002be10318}
 CatalogFile=TestPrimitiveDriver.cat
 PnpLockdown=1
    
 [DestinationDirs]
 DefaultDestDir = 13
    
 [DefaultInstall.NTamd64]
 CopyFiles = MyCopyFiles
    
 [DefaultInstall.NTamd64.Filters]
 AddFilter = PrimitiveDriverSvc,,Filter_Install
    
 [Filter_Install]
 FilterPosition = Upper
    
 [MyCopyFiles]
 TestPrimitiveDriver.sys
    
 [DefaultInstall.NTamd64.Services]
 AddService = PrimitiveDriverSvc,, MyService_Install
    
 [MyService_Install]
 DisplayName    = PrimitiveDriverSvc
 ServiceType    = 1               ; SERVICE_KERNEL_DRIVER
 StartType      = 0               ; SERVICE_BOOT_START
 ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
 ServiceBinary  = %13%\TestPrimitiveDriver.sys
 LoadOrderGroup = "PnP Filter"

And even thou I see the *Upper:

key being created, when I reboot the machine it seems like the PnP manager is not calling the AddDevice routine for this driver. I've tried getting prop DEVPKEY_Device_CompoundUpperFilters value for the PDO of the Disk and I get STATUS_OBJECT_NAME_NOT_FOUND. I wanted to know if I'm still missing something on the INF file or is there anything else that need to be done after calling DiInstallDriver for this INF ??

0 ·

diskdrivefilter.png (58.5 KiB)

Answer 2 · 2022-05-02T18:14:58.747Z

ZacLockard answered May 2, '22 PavelVarabei-7049 commented Jun 23, '22

Ah, sorry this is my mistake.

For class filters, AddFilter can only be done on classes that have specifically enabled the AddFilter syntax. Devices do not need to enable this directly when they use FilterPosition to add upper or lower filters. Apologies for the confusion, I had forgotten this detail. There is a lot of legacy to how class filters are added on systems and the weird behavior you're seeing (plus the exemption from having AddFilter enabled by default) is reflective of that. I'm hoping to get AddFilter turned on for all classes in an upcoming release so that we can improve this situation going forward.

· 5

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

n4r1B-3693 · May 02 at 07:44 PM

Oh I see, so just to make sure. Until the AddFilter syntax is enabled for all classes we have to stick with the legacy way using AddReg to install a class Upper/Lower filter??

0 ·

ZacLockard n4r1B-3693 · May 02 at 08:40 PM

Well specifically it needs to be enabled for the class you're adding a filter to, it doesn't need to be all of them, but yes.

1 ·

PavelVarabei-7049 · Jun 21 at 09:03 PM

So is there a solution to the original problem (DiUninstallDriver failing to remove the driver)? Should we call DiUninstallDriver and then remove the driver's service (like "sc delete" does) and from UpperFilters/LowerFilters registry value(s) manually?

0 ·

ZacLockard PavelVarabei-7049 · Jun 22 at 06:31 PM

Yeah that should work

1 ·

PavelVarabei-7049 ZacLockard · Jun 23 at 11:31 AM

Ok, thanks.
It's sad though it works this way, since I have to remove it from UpperFilters manually anyway. I am also considering not adding it to UpperFilters using .inf, but doing it manually, it might be a less problematic approach.

0 ·

question