Attaching a filter driver on top of existing PDOs

Hi, I’m still very new to Windows Driver Development. I have a (hopefully) quick question: In your Visual Studio driver project (suppose a WDK 8.1 KMDF one), how do you actually set a filter driver to be on top of specific PDOs, say HID-created PDOs (with hardware IDs that start with HID.…)? Is it through the actual code? Through the inf file? Co-installer?

Thanks!

The layering of the stack is all done through the INF file.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Saturday, January 31, 2015 11:16 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Attaching a filter driver on top of existing PDOs

Hi, I’m still very new to Windows Driver Development. I have a (hopefully) quick question: In your Visual Studio driver project (suppose a WDK 8.1 KMDF one), how do you actually set a filter driver to be on top of specific PDOs, say HID-created PDOs (with hardware IDs that start with HID.…)? Is it through the actual code? Through the inf file? Co-installer?

Thanks!


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Thank you. Also, if I’m trying to filter a pen/digitizer device, which driver am I exactly filtering? I saw in the diagram in this MSDN page (https://msdn.microsoft.com/en-us/library/windows/hardware/jj128406(v=vs.85).aspx) that mice and keyboard has KBDClass.sys and MouClass.sys, but for Touch, HidClass.sys just points directly to Win32K.sys, and pen/digitizers aren’t even mentioned.

Pen and digitizers are in the patter bucket, win32k or another subsystem opens the hid collection directly without an additional driver in the stack

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?1/?31/?2015 12:31 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Attaching a filter driver on top of existing PDOs

Thank you. Also, if I’m trying to filter a pen/digitizer device, which driver am I exactly filtering? I saw in the diagram in this MSDN page (https://msdn.microsoft.com/en-us/library/windows/hardware/jj128406(v=vs.85).aspx) that mice and keyboard has KBDClass.sys and MouClass.sys, but for Touch, HidClass.sys just points directly to Win32K.sys, and pen/digitizers aren’t even mentioned.


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

Thanks for the quick replies! So if I’m trying to build a filter driver that gets between HIDClass.sys and Win32K.sys, will my filter then be an (KMDF) upper filter to HIDClass.sys?

Don’t worry about hidclass. Specify a hid\xxx hw id in your inf and the right thing happens

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?1/?31/?2015 12:44 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Attaching a filter driver on top of existing PDOs

Thanks for the quick replies! So if I’m trying to build a filter driver that gets between HIDClass.sys and Win32K.sys, will my filter then be an (KMDF) upper filter to HIDClass.sys?


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

Like this?

[Standard.NT$ARCH$]
%KmdfHelloWorld.DeviceDesc%=KmdfHelloWorld_Device, HID\VID_xxxx&PID_xxxx

Yes, that would the inc before stamping runs on it

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?1/?31/?2015 1:27 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Attaching a filter driver on top of existing PDOs

Like this?

[Standard.NT$ARCH$]
%KmdfHelloWorld.DeviceDesc%=KmdfHelloWorld_Device, HID\VID_xxxx&PID_xxxx


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

Inc => inx

d

Bent from my phone


From: Doron Holanmailto:xxxxx
Sent: ?1/?31/?2015 2:39 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE: [ntdev] Attaching a filter driver on top of existing PDOs

Yes, that would the inc before stamping runs on it

d

Bent from my phone
________________________________
From: xxxxx@gmail.commailto:xxxxx
Sent: ?1/?31/?2015 1:27 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Attaching a filter driver on top of existing PDOs

Like this?

[Standard.NT$ARCH$]
%KmdfHelloWorld.DeviceDesc%=KmdfHelloWorld_Device, HID\VID_xxxx&PID_xxxx


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>

Thanks. By the way I apologize if this is a silly question, but I can’t seem to find the inx file in my project (the inf itself is there though)… are there special settings that I have to do in Visual Studio to enable generation of an inx file?

If you start from a sample or new project you will have an inx file. Any time you see an inx/inf with $xx$ syntax you need to run it through stampinf

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?1/?31/?2015 2:58 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Attaching a filter driver on top of existing PDOs

Thanks. By the way I apologize if this is a silly question, but I can’t seem to find the inx file in my project (the inf itself is there though)… are there special settings that I have to do in Visual Studio to enable generation of an inx file?


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

Thanks so much. However, I’ve got another issue after changing the HW ID from Root\KmdfHelloWorld to HID\VID_xxxx… When I try to deploy it on my target machine, the process always fails on the PerformDefaultDriverPackageInstallation phase, saying WDTF_TEST : System has no device the driver package can be installed onto (from the logs in Driver Test Group Explorer). Any ideas? I have a bunch of HID-compliant devices in my target machine whose HW IDs do start with HID\ …

You’ve been a great help by the way, I appreciate it. I see your name very often on blogs and MSDN questions, and if I’m not mistaken, you’re one of the lead engineers that works on the WDK. I appreciate you helping out an undergrad student.

Or did I have a wrong idea of what “xxxx” means when we say “HID\VID_xxxx”? I thought that using it would allow me to filter all devices that have HW IDs that start with “HID.…” but whenever I use that, that’s when the problem in my previous post arises. On the other hand, I tried copying the hardware ID of the HID-compliant digitizer on my target machine, and turns out that the deployment was successful. Of course this would be a problem if I want my driver to be filter pen/digitizer devices in general. Is there any way to do this (as opposed to vendor-specific devices)?

Thanks.

Yes ,xxxx is a placeholder. Look at the compatible ids to match on the usage page, not the hw id to folter all instances. Not that I think it is important to you, but you can’t get msft to sign a package matching in the compatible id

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?1/?31/?2015 8:18 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Attaching a filter driver on top of existing PDOs

Or did I have a wrong idea of what “xxxx” means when we say “HID\VID_xxxx”? I thought that using it would allow me to filter all devices that have HW IDs that start with “HID.…” but whenever I use that, that’s when the problem in my previous post arises. On the other hand, I tried copying the hardware ID of the HID-compliant digitizer on my target machine, and turns out that the deployment was successful. Of course this would be a problem if I want my driver to be filter pen/digitizer devices in general. Is there any way to do this (as opposed to vendor-specific devices)?

Thanks.


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

Thanks. And just to clarify, when you say compatible IDs that match usage pages, do you mean IDs of this type: HID_DEVICE_UP:p(4)_U:u(4) ? I found this on an MSDN page about HIDClass HW IDs for TLCs. And just curious, but is the reason why Microsoft will not sign this because of this type of HW ID being reserved for Windows INF files only?

By policy class drivers are first party

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?2/?1/?2015 7:32 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Attaching a filter driver on top of existing PDOs

Thanks. And just to clarify, when you say compatible IDs that match usage pages, do you mean IDs of this type: HID_DEVICE_UP:p(4)_U:u(4) ? I found this on an MSDN page about HIDClass HW IDs for TLCs. And just curious, but is the reason why Microsoft will not sign this because of this type of HW ID being reserved for Windows INF files only?


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

xxxxx@gmail.com wrote:

Thanks so much. However, I’ve got another issue after changing the HW ID from Root\KmdfHelloWorld to HID\VID_xxxx… When I try to deploy it on my target machine, the process always fails on the PerformDefaultDriverPackageInstallation phase, saying WDTF_TEST : System has no device the driver package can be installed onto (from the logs in Driver Test Group Explorer). Any ideas? I have a bunch of HID-compliant devices in my target machine whose HW IDs do start with HID\ …

Before you go on, allow me to point out another issue.

You cannot ADD a filter driver to an existing device stack using an
INF. Every INF file REPLACES whatever driver was there before. You can
use an INF to do your installation, but your INF must include the
standard HID driver as well as your filter.

However, you can install a filter driver without using an INF, just by
using an application. Installing a filter on an existing device
requires three steps:

  1. Copy the .sys file into place
  2. Create a service that points to the sys file
  3. Add the service name to the UpperFilters or LowerFilters registry
    key for the device you want to filter.

Step 1 and step 2 merely require admin privilege, and can even be done
in a batch file (with “copy” and “sc”). Step 3 requires using the
SetupDi APIs to find your device, fetch the registry key, modify it, and
replace it.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Hi Tim. Thanks for the insight! Please let me respond to the points you’ve made separately:

  1. INF Files

What you said seems to reflect what I’m seeing in my target machine after I’ve deployed my driver. For example, in my INF file I tried to use the HW ID of the “HID-compliant pen” that was a child of “Wacom Device”. This resulted in the “HID-compliant pen” entry in device manager to be replaced by my “KmdfHelloWorld Device”, whose device stack now looks like (from top to bottom): KmdfHelloWorld, mshidkmdf. Seeing this, I thought that I’ve successfully put my filter driver between the HIDclass (which I understand to be the HID bus driver, and uses mshidkmdf as a miniport driver) and Win32k (the OS kernel), which is what I thought I wanted (I’ll explain later in part 3 what I’m trying to do).

a) After reading your post, I’m now confused whether this is the case, or if I’m going in the wrong direction in the bigger problem that I’m trying to tackle.
b) Also, how do I obtain and include the standard HID driver (hidkmdf or mshidkmdf? I see either one on different machines) on my project? Or do I just have to add the appropriate sections/text in the INF file?

  1. Installing a filter driver without using an INF
    I understand that you mean that I can write a separate application that will install the driver, and so I don’t have to use an INF file (which means that I’ll exclude the INF file from the build if I go this route)?

  2. My main problem
    I’m trying to capture the input report data of a pen (coordinates, pressure, etc) before it gets to the OS - if possible, in any generic machine that has pen and touch hardware. Additionally, I’m trying to modify that pen data and and submit that modified data to the OS. Hence why I’m trying to get in between the uppermost driver in the pen’s driver stack and the OS. From what I’ve read, I can only do this using a KMDF filter driver, but please correct me if I’m wrong? Since I’m only targeting Windows 8.1 and later versions of Windows, UMDF 2.0 seems like a very good alternative.

> 3. Add the service name to the UpperFilters or LowerFilters registry

key for the device you want to filter.

And sometimes class filters are fine (without the need to add per-device).


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

xxxxx@gmail.com wrote:

  1. INF Files

What you said seems to reflect what I’m seeing in my target machine after I’ve deployed my driver. For example, in my INF file I tried to use the HW ID of the “HID-compliant pen” that was a child of “Wacom Device”. This resulted in the “HID-compliant pen” entry in device manager to be replaced by my “KmdfHelloWorld Device”, whose device stack now looks like (from top to bottom): KmdfHelloWorld, mshidkmdf. Seeing this, I thought that I’ve successfully put my filter driver between the HIDclass (which I understand to be the HID bus driver, and uses mshidkmdf as a miniport driver) and Win32k (the OS kernel), which is what I thought I wanted (I’ll explain later in part 3 what I’m trying to do).

You should go read the INF file for your Wacom device and see what
driver they install.

a) After reading your post, I’m now confused whether this is the case, or if I’m going in the wrong direction in the bigger problem that I’m trying to tackle.
b) Also, how do I obtain and include the standard HID driver (hidkmdf or mshidkmdf? I see either one on different machines) on my project? Or do I just have to add the appropriate sections/text in the INF file?

As far as I know, those drivers are merely adapters that allow KMDF
drivers to be used in the HID stack. They are not the HID drivers
themselves

Remember that a HID driver stack consists of a number of different
drivers, each one operating at a different level of abstraction. A USB
mouse, for example, starts with the USB system, then hidusb.sys, then
hidclass.sys, then mouhid.sys, then mouclass.sys, and finally into
Win32K. You need to know which layer you want to intercept.

IF you truly need to replace the INF, then you would use Needs/Includes
statements in your INF to invoke the sections in the standard INF files

  1. Installing a filter driver without using an INF
    I understand that you mean that I can write a separate application that will install the driver, and so I don’t have to use an INF file (which means that I’ll exclude the INF file from the build if I go this route)?

Right. You wouldn’t be creating a driver package at all. All you need
is the signed SYS file, and an appropriate installer application.

  1. My main problem
    I’m trying to capture the input report data of a pen (coordinates, pressure, etc) before it gets to the OS - if possible, in any generic machine that has pen and touch hardware.

You’re making a huge assumption that all pen devices act identically.
I’m not convinced that’s true.

Additionally, I’m trying to modify that pen data and and submit that modified data to the OS. Hence why I’m trying to get in between the uppermost driver in the pen’s driver stack and the OS. From what I’ve read, I can only do this using a KMDF filter driver, but please correct me if I’m wrong? Since I’m only targeting Windows 8.1 and later versions of Windows, UMDF 2.0 seems like a very good alternative.

UMDF can be used to create complete HID minidrivers, but UMDF filter
drivers require special registry magic. Remember that every UMDF driver
in a stack means a kernel/user transition, and if you aren’t the top
device in the stack, another user/kernel transition after. That adds
overhead.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.