Code sign VISA raw USB driver for Windows 8

[Perreijn]

Hi guys,

I have written a LabVIEW program that communicates with a USB measurement device using NI-VISA (USB raw class).
With the NI-VISA Driver Development Wizard I created two driver .inf files (for XP/2000 and 7/Vista).
It works like a charm on my own computer (Win 7, 64-bit) and on computers running Windows XP and 32-bit versions of Windows Vista and 7.
I can also get it to work on the 64-bit versions of Windows Vista and 7 by using 'disable driver signature enforcement' prior to installation of the driver.
Once the driver is installed it is listed under 'NI-VISA USB devices' in the Windows Device Manager. After that I can re-enable driver signature enforcement, the device will continue to work, even after a reboot.

Alas, in the 64-bit version of Windows 8 it's not that easy. Yes, you can temporarily disable driver signature enforcement, but not on computers that use 'secure boot' and/or UEFI.
I know that are ways of disabling secure boot in the UEFI, but I don't want to that on the computers of our customers. It looks bad and might introduce a lot of security problems.

The logical next step would be to sign the device driver. Our company does have a valid kernel-mode code signing certificate and we have signed other drivers with it in the past.
The problem is that I don't know how to sign my NI-VISA based device driver. According to the .inf file it uses WinUSB.sys, a generic Microsoft USB driver (part of the Windows Driver Kit, I believe).
Winusb.sys is already signed by Microsoft and I could replace the signature, but that probably will not work without some inf tweaking and generating a new catalog file.

Can somebody please give me some pointers on where to start? As a reference I have attached one of the inf files to this post. This inf file works on Windows Vista and 7.

Is it even possible to create a signed driver based on NI-VISA raw?

Thank you in advance for your help.

Paul

[pankaj · Accepted solution]

Here is a KB that describes a workaround.

http://digital.ni.com/public.nsf/allkb/36DB8D6AC385052786257A940066A421

From what you have written, you would need to generate a catalog (.cat) file from the inf (as described in Step 1 of the KB) and then sign the .cat file with your certificate, the same way as you would sign your other components. The inf and cat are always distributed together. The inf has information about the cat file that has the signature, and the cat file has the signature information. Since you have already been distributing components signed with your own certificate, I am sure you can figure out the process, but please let us know if you have any other questions.

Thanks,

Pankaj

[Perreijn]

Hi Pankaj,

Guess I missed that KB article . After some experimenting I managed to sign the driver for Windows 8 x86 (the x64 machine wasn't available, will try that next week).
For future reference here are a couple of tips for other users that might struggle:

- if you want to copy inf2cat to another folder (to make it easier to use), don't forget to include WindowsProtectedFiles.xml and the dll files (C:\Program Files (x86)\Windows Kits\8.0\bin\(x86 or x64)). If you don't, inf2cat doesn't recognize winusb.dll as a 'special' file and complains about a missing signature.

- a signed driver created with the NI-VISA driver development wizard on Windows 7 64-bit should work under Windows 8 64-bit, but Windows 8 might still not recognize the signature.
The easiest solution is to run the driver wizard again, but this time on a Windows 8 machine, run inf2cat there and then sign it.

Thank you very much for your help.

Paul