Skip to content

Commit 1146f62

Browse files
committed
added instructions for disabling signature enforcement
1 parent fa90118 commit 1146f62

File tree

1 file changed

+41
-11
lines changed

1 file changed

+41
-11
lines changed

README.md

Lines changed: 41 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -146,47 +146,77 @@ generate your Makefile.
146146

147147
Signing
148148
-----------
149-
150149
To install a built-from-source or a nightly (from github actions) driver, you need to sign it
151-
In this section, I will show how to compile the driver using test-signing.
152-
Example commands are given for each steps but it is recommand to check the microsoft documentation link about test-signing, so you know what you are doing
150+
In this section, I will show how to disable driver signature enforcement, or how to sign the driver using test-signing
151+
Warning : both of these solutions aren't perfect, if you are looking for a everyday-use it is recommanded to use the release builds, which are signed with a Microsoft-trusted key.
152+
153+
154+
## Disabling signature enforcement
155+
Note : this isn't persistent accross reboots
156+
157+
Relevant link : https://docs.microsoft.com/en-us/windows-hardware/drivers/install/installing-an-unsigned-driver-during-development-and-test
158+
159+
### 1 - Reboot your computer without driver signature enforcement
160+
161+
(This can be done by pressing the 'Shift' key while rebooting the computer, this will take you to a special screen from which you can select "Troubleshoot" -> "Startup settings" -> "Disable driver signature enforcement")
162+
163+
### 2 - Install the driver
164+
165+
Open the previously downloaded artifact from Github Actions (or mimic the directory structure and fill it with the binaries you just compiled), right-click the btrfs.inf file -> install
153166

154-
More information can be found at https://docs.microsoft.com/en-us/windows-hardware/drivers/install/test-signing
167+
A window saying "Microsoft can't verify the publisher of this driver" should pop-up. Click "Install anyway"
168+
169+
If the window didn't show up, the driver probably wasn't installed, make sure you booted your computer with driver signature enforcement disabled.
170+
171+
The computer should next tell you to reboot your computer
172+
173+
### 3 - Reboot the computer again without driver signature enforcement
174+
Follow the same instructions as step 1
175+
176+
### 4 - Done !
177+
The driver should now be installed ! Note it will only load when the computer is started without driver signature enforcement
178+
179+
180+
181+
## Test-signing the driver
182+
Note : This method is harder to put in place, and has the only benefit of persisting after reboots.
183+
184+
Example commands are given for each steps but it is recommand to check the microsoft documentation link about test-signing, so you know what you are doing
155185

156-
Note : this is not practical for a everyday use
186+
Relevant link : https://docs.microsoft.com/en-us/windows-hardware/drivers/install/test-signing
157187

158-
**1 - Put your computer in test mode**
188+
### 1 - Put your computer in test mode
159189

160190
test-signing doesn't seem to work with Windows by default. You will need to put your computer in a special mode to allow test-signing.
161191

162192
`bcdedit /set testsigning on`
163193

164194
Note : you might need to disable Secure Boot for this to work
165195

166-
**2 - Generate a MakeCert certificate**
196+
### 2 - Generate a MakeCert certificate
167197

168198
This certificate will be used to sign the catalog file of the driver
169199

170200
`makecert -r -pe -ss PrivateCertStore -n CN=Contoso.com(Test) ContosoTest.cer`
171201

172-
**3 - Install the certificate to your system**
202+
### 3 - Install the certificate to your system
173203

174204
For your certificate to be effective, it needs to be installed in the "Trusted Root Certification Authorities" certificate store of the computer you want to install the driver on.
175205
You can add it by launching "CertMgr" **as administrator**, selecting the "Trusted Root Certification Authorities" certificate store, and importing the .cer file generated earlier
176206
(The command given on the documentation doesn't seem to work and just launches the CertMgr GUI)
177207

178-
**4 - Generate a catalog file for your driver**
208+
### 4 - Generate a catalog file for your driver
179209

180210
You will need the "Inf2Cat" tool, installed as part of the WDK.
181-
Run the command in the same directory as your .inf file (or modify the /driver flag)
211+
Run the command in the same directory as your btrfs.inf file (or modify the /driver flag)
182212

183213
The command will differ in your case (because of the path) but here is the one I used :
184214

185215
`"C:\Program Files (x86)\Windows Kits\10\bin\x86\Inf2Cat.exe" /os:10_NI_X64 /driver:.`
186216

187217
Note : this was tested in Windows 11, you might need to change the values of the /os flag according to your Windows version
188218

189-
**5 - Sign the catalog file**
219+
### 5 - Sign the catalog file
190220

191221
Simply sign the catalog file of the driver with the certificate you generated
192222

0 commit comments

Comments
 (0)