How to Kernel Debug Connected Standby/Modern Standby systems?

October 24, 2016


Debugging a Modern Standby (Connected Standby earlier) scenario can be challenging as there are some smaller subtle things to keep in mind. Most modern standby/connected Standby systems are newer systems with USB 3.0 xHCI controllers so this blog post only focuses on systems which support USB 3.0 debugging.

What you need:

  1. USB 3 cable –
  2. USB Type C to type A adapter – Needed only if the device doesn’t have a USB Type A port
  3. Windbg Bits – Many sources including the Kits —  WDK or ADK

Methodology to setup Kernel Mode debugging

  1. Setup the machine for USB 3.0 debug  as mentioned here:
  2. Make sure you Disable Secure Boot in the BIOS menu
  3. Hook up the cable as follows  setup
  4. Check the USB device hierarchy and turn  off all the components. You can do this from device manager, usb tools usb_hierarcy
  5. Disable Turning off  USB stack components – Hubs and controllers on target Disable Powersaving on USb controller For the uSB hub, Uncheck the box to allow the computer to turn off the debice to save power  usb_hub_power
  6. Disable Powersaving on USB HUB/s — For the uSB xHCXI controller, Uncheck the box to allow the computer to turn off the device to save power usb_hub_power
  7. If there are multiple controllers or Hubs make sure you pick the right one where you plan to debug . Also if there is another level of hub in between do the same for that as well.
  8. Debug away!!


Windows updates on Windows 8.1 almost made my system unbootable

March 15, 2016

I  have an older  (Haswell based) X1 carbon which is running Windows 8.1. I was installing updates on it and after that the system wouldn’t boot and would keep getting to recovery loop. The system is bit lockered. I couldn’t get the system into safe mode or enable debugging. System restore had restore points as I seldom log into my local admin accounts and use mostly my domain  joined account. I tried the startup repair diagnosis and that didn’t find much either. So the system was pretty much unrecoverable. I went and looked at the SRtlogs (attached) and they pointed to a corrupt cng.sys binary. Sure enough it was reduced to 4 kb in size. I tried to patch it with a binary from another 8.1 system but that didn’t help. In the end I ran the sfc tool and that’s when I started seeing issues. Error from the tool:

“Error :There is a system repair pending which requires a reboot to complete. Restart windows and run sfc again”.

I researched the Windows community board which actually led to the diagnosis that there was a pending update which was for whatever reason causing the behavior and found the dism command below. Ran this and rebooted the system came back online.


dism.exe /image:C:\  /cleanup-image /revertpendingactions

The drive above could be D: or another one.  Check your system for the drive which has the Windows, Program Files etc directory to be sure.


If you get stuck in a loop with the message Windows couldn’t update the system… Try F8 to use restore point or try and reeboot before you reach the We cant install the update screen and this will cause recovery to be invoked. Happy fixing…

 I cant imagine non technical savvy user doing this…


Hope this helps!!


Windows 10 Power management

July 13, 2015

Win 10 scenarios covered

  • Battery Saver — For Better reporting accuracy, OEMs may need to run E3 micro benchmarks
  • Modern standby — Cheaper alternative to connected standby
  • Power scheme settings — Hibernate for CS systems
  • Project Centennial — Converting Win 32 apps to UWP apps

Battery Saver

  • New Windows 10 Shell option which shows battery consumers on the system at runtime
  • This uses a general model of the platform to indicate battery use
  • The accuracy of data is higher if OEM runs micro benchmarks on their platform or use the Maxim chip at an additional cost to the BOM





Modern Standby

Why does it matter?

  • CS hardware requirements do have a BOM adder(Storage and Network)
  • Modern standby allows for instant on
    •     S3 systems from telemetry may have twice as large S3 resume


MS_1 Ms2

  • Background activities (non network related) can still happen
    • Store apps activities
    • Reminders
    • Bth sync
                           Battery drain Hibernate timer OEM setting
Exceptional 9 days or longer battery life Use of Hibernate timer is optional
Ontrack 6 days or longer battery life Use of hibernate timer after 24 hrs is recommended

Modern Standby Implementation


Power management – Hibernate times

  • New Win10 Hibernate Settings for end user
    • Default is same as Win 8/8.1
    • Not to hibernate the system
    • Changing the setting allows the system to Hibernate while in CS
    • Criteria to set the Hibernate values


Lowering power consumption with UWP apps

Build 2015 – OpenSource, Partners, visual Studio, Cloud, IoT… Need I say more?

May 27, 2015

Build 2015 was full of treasures. Partnerships, open Source integration, Visual Studio, Azure, IoT were the big areas. New face of microsoft with a focus on open source and 3rd party support like github was a huge part of the Visual Studio suite.

There was so much of new stuff disclosed at the Conference. The Key notes(keynote1 and keynote2) gave an idea:

The big themes of the conference was developing apps for the Cloud and developing UAP apps with Visual Studio 2015 platform. You could download the preview version of the community one here.
It was clear that Microsoft had been listening to the developers and was beginning to integrate with open source tools. Azure was a big focus area where developers from a lot of SMB varying from insurance /accounting to gaming were looking at Azure as a potential platform. In the space of Big data Azure Data factory was an interesting talk about reuse patterns for Big Data with machine learning analysis built in step as part of the workflow.
Visual studio tools for converting iOS and Android apps to Windows apps was well received. It is surprising how many developing on iOS using Objective C and were delighted to hear cross platform support for Objective C. The new Visual Studio Code IDE has an intelisense rich environment to build Android apps was a welcomed by everyone. This should be a welcome change from the Android IDE’s such as h Eclipse or Android Development studio. Check the newest member of the Visual Studio family which is pretty lightweight and takes less than 60 Mb of space. vs Ide
Image below shows the power of the Visual Studio platform

universalwindows platform

Halo lens created a lot of buzz with developers being able to play with it. Lot of verticals such as education and Architecture. Gaming maybe next …
Big buzz events of the event were Halolens and support for Objective C and Java.
Visual Studio support of Open source software such as Alljoyn and Github and 3rd party software especially in the Big data space and its integration with Visual Studio was very well received.

Key takeaways from Builds

App. Gap between Windows Phone and IoS /Android will be bridged by project Astoria and Islandwood. This allows developers to port their existing IoS apps and Android Apps to Windows apps. There maybe restrictions on phone hardware needed to run such apps. This is great news for Windows Phone OEM’s.

Win32 apps to to UAP apps. with project continuum
This I think is one of the best messages not just for developers but also for OEMs to move their first and third party apps to UAP apps from Win32.
This was ISV’s can convert their Win 32 apps to UAP apps by using Project Centennial. The apps. can then be purchased using the Store. This helps the apps. to be more secure, less resource intensive and battery freidnly.

Edge the new browser – Better web experience
Key reason for using the browser is primarily around because it will work well with optimized sites, supports Cortana and many other gems such as Web extensions, pointer lock for shooter games and reading lists . IE due to compatibility reasons may not support but with forked code. This allows for edge supportability forked with IE compatibility. The best part is that Edge can launch IE for sites which are not compatible for example which need VB script.
Other things are distraction-free offline reading and built-in note-taking & sharing. Below is a comparison of Alaska airlines website on a mobile device.


Design for Win 10 by the user for the user
Please ask folks from outsider to join the insider program to get an early feel for Windows and provide feedback as the feedback is taken seriously including for UX. The builds with new features are flighted directly to the system.

One  Store

For those of you have written Windows apps for phone and desktop OS like me on Win 8.1. The experience can be nerve wrecking as you need to create 2 accounts one for Windows Phone and one for desktop. Duplicate everything from monetizing, geographies of release, price, screenshots and descriptions. I just saw a note from Microsoft for my store application called “SecureData”


Desktop :

There will be now one store, one submission and one process for everything. One does have the option to create multiple packages for OS or platform…


Win10 app migration

There will be now one store, one submission and one process for everything. One does have the option to create multiple packages for OS or platform…


Project Continuum

What is Continuum?

  • Two apps run simultaneously on two screens
  • Windows Apps transition seamlessly and look beautiful on any screen
  • Keyboard and mouse support

To make the application adaptive to any screen size understanding effective pixel is key. Effective pixel is independent of screen. Some terminology. More on that here:

display terminology

Think about how your app. Scales to the big screen. Scaling which depends on pixel density and viewing distance. There is no rule of thumb that a desktop has higher scale than a mobile phone. It is primarily dependent on pixel density and viewing density.


Some other cool features include using the other screen not just to mirror but to take advantage of the 2 screens simultaneously with multi screen API …


Some technologies to watch out for

Nano Server – Nano server doesn’t just remove features but is a self contained engine. Microsoft defines its Nano Server as a “headless, 64-bit only deployment option for Windows Server.” It’s like Server Core, except that it’s 20 times smaller. The compressed size or reduced server “footprint” brings a number of benefits, including fewer security vulnerabilities to address, reduced patch and reboot times, and scalability improvements.


  • 3d printing
  • IoT Maker movements – Raspberry Pi and Arduino

Lots of great talks on IoT. Some of the interesting ones given below.

IF you are considering buying parts for maker projects here is an interesting site.

Confidence invoking statements

Windows itself is evolving with feedback from Insider program. Instead of fixed set of design the design is evolving which appears to be by design and is sometimes misconstrued as instability.

The other comforting thing for developers is that the new browser edge which is a UAP was designed using the same tools as a developer would use for their own apps.

Summary of the key areas


Area Features
Universal App. Platform(UAP) platform Universal App. Platform offers the capability to write your app. Once and run it on all Windows Platforms starting with the Windows Embedded (Athens) to Mobile to Desktop to new Surface HubApps are coded to Universal App. Platform and not to the hardware platform or Operating Systems using Windows.Foundation.Metadata.Apiinformation. What that means is that applications shouldn’t be designed for Win 10 Mobile or Win 10 desktop etc This alleviates the need to code to least common denominator hardware they would be supporting
Visual Studio Visual Studio teams had a busy year with a lot of new features.. To name a few:·         Web Apps(JS etc),·         Android (Java)·         iOS(objective C),·         Open source integration(Git hub, Alljoin, Big data programming ),

·         Cloud apps,

·         Unit testing, perf.

·         New VS Code part editor part IDE

One $tore for all Windows Platforms One can now link apps meant for Windows Phone to Dekstop.1 submission for all, 1 certification but and 1 pricing. Typically the greatest common denominator if one has apps on both mobile and Desktop is chosen. The base price from is chosen from Windows (desktop), screen shots are chosen from both to give user flexibility, category is chosen from windows(desktop) etc…There is the option of having multiple packages for old OS 1 package. The dashboard is on is redesigned.

Some folks asked me about the sessions I attended and Below are the some sessions I found useful. These are not in any particular order and cover ranging topics from Azure, IoT, UX, Programming:

Sessions I found useful

Topic Link
Nano sever : A Cloud Optimized Windows Server for DevelopersMicrosoft defines its Nano Server as a “headless, 64-bit only deployment option for Windows Server.” It’s like Server Core, except that it’s 20 times smaller. The compressed size or reduced server “footprint” brings a number of benefits, including fewer security vulnerabilities to address, reduced patch and reboot times, and scalability improvements.To address the cloud, the GUI built into the server had to go. Instead, Nano Server gets managed using a remote GUI through a browser-based application. For instance, the presentation showed off a browser-based dev-ops program called Visual Studio Release Management. It doesn’t use Remote Desktop Protocol to remote into a server. Instead, it uses Core PowerShell scripts for management, along with Desired State Configuration, which is PowerShell’s push-pull configuration technology.
Porting Android apps using Astoria There are some hardware restrictions on the memory and disk space for such apps.
Project Centennial”: Converting your Classic Windows App (Win32, .Net, COM) to a Universal Windows App for Distribution in the Windows Store This allows Win32 apps to run in a container security. The app becomes a UWP app and hence can run on Xbox, Halo lens, Surface Hub etc.To help support Win32 apps which need Winsock, CreateThread() API’s these API’s will be available to UWP apps also. WMI, DAM, COM works just like Win32. Access to click once API’s lost after the first launch.Some features like active X deployment wont work etc.
Project Spartan”: Introducing the New Browser and Web App Platform for Windows 10 Key reason for using the browser is primarily around because it will work well with optimized sites, supports Cortana and many other gems such as Web extensions, pointer lock for shooter games and reading lists . IE due to compatibility reasons may not support but with forked code. This allows for edge supportability forked with IE compatibility. The best part is that Edge can launch IE for sites which are not compatible for example which need VB script.Other things are distraction-free offline reading and built-in note-taking & sharing. Below is a comparison of Alaska airlines website on a mobile device.
Windows Design for Developers: An Executive Panel Windows Insider program feedback has been taken into account for UX design for Win 10.One of the better talks I attended. This talk gave me a perspective on how much of Win 10 UX design is incorporating feedback from Windows Insiders Only slides
Optimizing Windows Apps for ContinuumEffort involved in letting applications working across multiple screens is very little especially for mobile. You can resize your application on desktop to test the look and feel on mobile.Some key concepts are effective pixel, pixel density and viewing distance etc. More here:
Building Rich, Contextually Aware Universal Windows Apps Using Sensors There is support for batching sensor request to save on power. Applications can use background triggers to detect things like user activity (like walking etc). There is also availability of sensor history data.Custom sensor can be easily added and apps. can use GUID to detect the device. Sensor simulators are available from Github to build and test applications.
Store: Deep Dive on Publishing Universal Windows Apps From now on there will be :·         one store for everything,·         one submission for all,·         one certification

Optional support for multiple packages for OS and platform are available.
Developing 3D Printing Apps and Services in Windows 10The 3d print space has many individual,  challenges with nonstart drivers, low print success rate, limitations on information exchange,  limitations in existing formats , formats not designed for 3d format.The 3mf consortium tries to solve some of these with open source, compact human readable. This will allow for repair capabilities API, plug and play, enable cloud printing. There will 3d builder inbox which will allow for visualizations and validation and repair. This removes the single highest barrier to entry removed.3d content is open for partners to develop. More details here:
API Contracts (or How I Learned to Stop Checking OS Versions and Love Feature Detection)Least Common Denominator API’s really suck,. Instead have adaptive apps which run on multiple platforms. Use the Windows.Foundation.Metadata.Apiinformation classes and methods to find out what features your app. Targets.

Some things I found useful to try

  1. Join and give feedback on Windows Insider – This feedback contributes to many things including UX design etc.
  1. Try Cortana – Scenarios such as weather, how much RAM do I Have?
  2. Try Project Spartan/Edge browser on your Nokia Phones and Desktop’s
  1. The build app. Was great to get the summary of all sessions in case you are curious on any developer topic. The app. Works on Windows, Android and iPhone platforms.
  2. INSTALL Visual Studio 2015 and VS Code

VS 2015-

VS Code –

Etc etc

Comparison of Developer conferences

In this competitive world it is difficult to not compare. I looked at the 3 of the more important key notes of developer conferences.

Build in my opinion had one of the best key notes. The Google key note was dull and lacked appeal, IoS on the other hand was not bad but Apple ecosystem is very limited compared to what Microsoft covers. Build had powerful demos and tremendous wow factor with Halolens especially. We will see more in a couple of weeks when Apple and Google 2015 conferences are held.


Overall I think Win 10 is going to be a great platform for at least a billion devices. So if you are a developer this present s great opportunity on writing all sort of apps. for so many different platforms…

Part 2 of this coming soon looking at more cool windows features …

Read the rest of this entry »

bulk copy data

May 5, 2015

the main goal of this blog is to focus on tools available for doing a bulk copy to a SQL server on windows.

Inserting sequentially –
Sqlcmd – it is a freat tol if you have the data on the machine hosting the SQL server. You can use it if you have the data on a network share but you run into issues with credentials.

BCP- It is a great tool but you need to understand the format files and the syntax of the command. Bcp is like a scripting language where the sepecial characters like “,”, “;” etc. are to be carefully monitored. Also, it is very fical when it comes to validity of source data. For eg: Data time format fields with hours or minutes or seconds not in the HH:MM:SS format will give you a lot of trouble. Missing leading 0’s can be cause of many an issue.

Debugging – Insert a field manually and get it using bcp out.

Hibernate and Hiberfile sizes

June 13, 2014

Windows reserves typically 75% of the Memory for Hiberfil.sys . This is normally enough after compression but maybe less especially if you use memory tools. The way to change hiberfile size is as follows :

powercfg /h /size

To turn off Hibernate use the following command:
powercfg /h off

Turning off hibernate in Windows8+ is:
1) No fast startup so impact on boot time
2) No way to save data if the battery reaches critical levels.
3) No way to save data on Thermal conditions

Decrypting wdf01000.sys interrupts with WPA

June 13, 2014

If you are trying to figure out which WDF driver is the source of all interrupts there is a way out. Since wdf01000.sys fields all interrupts and then calls the actual driver, it is difficult to figure out which driver caused the interrupts. Fortunately, there is a way out: You need to use the trace flags in the kernel – WDF_INTERRUPT and WDF_DPC. You can find all Kernel trace flags by the following command: “xperf -providers KF” .

You can trace as follows: ”

xperf -on diageasy+WDF_DPC+WDF_INTERRUPT+0x48000000+PROC_THREAD+LOADER+INTERRUPT+DPC+CSWITCH+TIMER+CLOCKINT -stackwalk TimerSetPeriodic+TimerSetOneShot+CSwitch+readythread+profile -clocktype perfcounter -buffersize 1024 -minbuffers 1024

xperf -d test.etl

Tidbits on technical interviewing

November 14, 2011

I have interviewed a lot of candidates for various roles within Microsoft. They range from college graduates to automation testers.
I broadly qualify them under 2 categories:
1) college hires for driver development
2) Automation using powershell
College Hires of Kernel/driver development
For college hires my interview style was to make sure I give them questions which ar not easily available off the internet. For that purpose I always used questions or challenging problems which I was working on at that time. Also, I tried to keep my questions consistent to compare candidates and since I knew the approaches and solutions pretty well.

One question I asked which was typical of what that candidate would be expected to do was to give the candidate a help guide for a particular kernel API and then showed a snippet of code and asked him to figure out what was that doing. For eg: Given the help page for “InterlockedCompareExchange” ass the candidate to figure out what some piece of code was doing. It normally is a good test of understanding of code and kernel concepts.

Some other areas which I would quiz on for kernel/driver development positions:
1) IRQL’s
2) Synchronisation primitives
3) C coding
4) Virtual memory

If the candidate got through my coding question I would give some logic puzzles to keep it interesting. More coding questions sometimes just makes the interview dull.

Categorie 2 – Automation code developemnt
Recently we had a need to hire someone who could help automate some tools. I have realised over time that on of the best skills for automation is not C# but powershell. With the cmdlets support working with powershell makes for really fast development time. It has the caveat of no type safety but is great for smaller projects which need to be developed quickly. The typical thingsin our probelm space were parsing input in .txt, .csv files etc reporting as html output etc
For eg: I saw that for a problem of finding all 3rd party exes under “program Files” folder it takes a person around 2-3 hrs to solve in C# given a developer with 5 yrs of experience. However consistently most candidates solved under 1 hr using powershell.

There are several such examples I came across.

My goals were to wait for the right candidates with a good mix of technical skills (powershell experience of more than 6 months) and good soft skills (self starter, sincere and detail oriented etc). I let the recruiters know to do their own filtering thus reducing the onus on me as the sheer number of candidate resumes I was getting was enormous.
One way i decided to save time was to have a phone screen prior to meeting the candidate face to face. This saved me immense amount of time. My phone screen was to give the candidate an introduction to the position followed by giving him a real world problem to solve using powershell. All problems were the ones that I encountered while trying to automate and i would give the candidate an hour to solve. Some examples:
1) Parsing and reporting question(phone screen):
Given a .txt file parse it and then generate an HTML report with some tables.
2) Simple question – good to give the hiring agency
Given a root path create folders with iteration numbers every time the script runs. For eg:
If the root is c:\test. The first time a script is invoked create C:\test\1\
If the script is invoked a second time, it should recognise that c:\test\1\ exists and create c:\test\2\ and so on.

Things to watch out for:
The code shouldn’t take more than 20 lines of powershell in the worst case
Easily tested by powershell .\.ps1

3) ) In person interview
Find all 3rd part exes (this is not literal but just omitting Windows or Microsoft in the folder or exe name was enouh) under program files etc.
Things to watch out for:
Program files under 64 bit system has 2 folders for program files. Try running the powershell script on your own machine and see if it works and shows the correct output.

I gave the candidates normally an hour and kept the time consistent to compare candidates. Also, the goal was to not only look at their problem solving capabilities but also ability to ask for clarifying questions. If the solution was not well formed I would give feedback and see if the candidate had the inclination to send me an improved solution. This also showered some light on the candidates sincerity to improve and take feedback besides communication.

In the face to face interview I would more whiteboarding and sometimes focus on other soft skills lile being detail oriented and creative . I also woudl ask at least one more member of the team to interview in case the candidate had to work with him and also to get another picture.

Hope this helps as it has helped me tremendously to hire some great candidates. They are worth it as the extra amount of time spent in picking the right candidates pays very rich dividends when it comes to explaing problems and finding solutions.

xperf tidbits

September 13, 2011

If you have a relatively large trace like 4gb+. you wil encounter opening those with xperfview. You may see error 0x800f007e. This is because you run out of VA space on 32bit sytetm. Try opening it on a 64 bit system.



Good video on Creating a bottable USB disk

Installation and Signing of filter drivers

August 29, 2011

My goal is to demystify and make the process of install of filter drivers simpler. I spent time in this blog describing install issues, driver signing and some miscellaneous topics like PCI express capabilities. I will go into more depths of bus and class filter drivers in my next blog. In this blog I tackle the issues of deploying, debugging, signing filter drivers and small tidbits on PCI express capability structure defined in the PCI spec. There are lots of general guidelines in the Windows Driver Kit(WDK) on how to write filter drivers.

The figure below shows types of filter drivers and where a filter driver can be in the device stack.

FIlter driver types

The toaster filter driver in the WDK is a good starting point: The toaster sample set is huge and shows how to write different types of filter drivers – upper/lower class, bus and device filter. The filter deriver I recently wrote was a PCI bus filter driver and a USB class filter. Among other things the challenge was debugging and installing it.

Class filter  – If you instantiate a CLASS filter, you do so for all devices in the CLASS. Thus, any new devices that are added in the filtered device class wind-up having the filter instantiated. More details here:

Bus filter drivers typically add value to a bus and are supplied by Microsoft or a system OEM. Bus filter drivers are optional. There can be any number of bus filter drivers for a bus. A bus filter driver could, for example, implement proprietary enhancements to standard bus hardware. For devices described by an ACPI BIOS, the power manager inserts a Microsoft-supplied ACPI filter (bus filter driver) above the bus driver for each such device. The ACPI filter carries out device power policy and powers on and off devices. The ACPI filter is transparent to other drivers and is not present on non-ACPI machines.

 Debugging the pci bus filter – USB is not a great means for debugging it as the USB controllers which are PCI devices didn’t do too well when my filter driver hit a bug. That’s why resorted to 1394 and serial. I all my initial development and debugging on a desktop with serial ports and then started testing on a laptop. Inf file The install is challenging in how you need to write the inf file and then how do you install the filter driver. The places where this inf differs from a regular function drivers inf is the key to specify whether this is an upper or lower filter. Since this is a PCI bus filter it has the needs and Include directive as well since it is dependent on the PCI bus driver. Note the driver is a boot start since it is a PCI bus filter. It also uses the System class.

The highlighted part in  bold below is the one unique to filter drivers.


Signature=”$WINDOWS NT$”







DefaultDestDir = 12


1 = %DiskId1%,,,””


PCIfilter.sys  = 1,,


; Install Section





%PCIfilter.DeviceDesc%=PCIfilter_Device, *PNP0A03

%PCIfilter.DeviceDesc%=PCIfilter_Device, *PNP0A08











;————– Service installation

; Function and filter driver for the bus




AddService = PCIfilter,, PCIfilter_Service_Inst

; ————– busupper Driver install section


DisplayName    = %PCIfilter.SVCDESC%

ServiceType    = 1               ; SERVICE_KERNEL_DRIVER

StartType      = 0               ; SERVICE_DEMAND_BOOT

ErrorControl   = 1               ; SERVICE_ERROR_NORMAL

ServiceBinary  = %12%\PCIfilter.sys

LoadOrderGroup = PnP Filter



MSFT = “Microsoft”

StdMfg = “(Standard system devices)”

DiskId1 = ” PCI  Bus
Installation Disk #1″

PCIfilter.SVCDESC = ” PCI Bus Upper Filter”

PCIfilter.DeviceDesc = ” PCI Bus filter”


devcon.exe install pcifilter.inf *PNP0A03

if the above fails

devcon.exe install pcifilter.inf *PNP0A08

NOTE: devcon.exe is a tool in  the Wdk

Conmmand line way to right click and install an inf

rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 .\usbcfltr.inf


You will need to reboot the system after install.

Installation on 64 bit system

You will need to enable test signing to install the filter or sign it.

bcedit /set testsigning ON

Debugging inf issues in install

To do this we need to turn on the verbosity
levels in the Setup logs to look at the  Setupapidev.log .

The default value for log levels is  0x2000ff00

Turning the verbosity of logging

Setting SetupAPI Logging Levels

OSR’s link –

Checking all the classfilters

For the USB class filter I wrote this command is what I used. More information in devcon help

devcon classfilter usb lower

Uninstall a class filter

  • using devcon.exe

devcon -r classfilter usb lower !usbcfltr

  • Registry

Renaming the key in the registry. For eg: If the name of the service is
usbcfltr, look for that in the registry and rename it.

Device stack after install of PCI filter driver

This is how the device stack looked for :










                                                          PCI root port

The attachedDevice field in the DEVICE_OBJECT structure points to the guy above him in the stack.

Getting PDO from an FDO

This is a common operation for writing filter drivers.

You can send an IRP_MN_QUERY_DEVICE_RELATIONS type TargetDeviceRelation down the stack to get a
referenced pointer to the PDO.

Signing Drivers during
Development and Test (Windows Vista and Later)

The following link describes the steps involved.

The basic steps are outlined below with examples. Note the example  just show one way of doing it and not the only way. You will need the WDK installed to use the tools  for this.

  • Create a certificate called  testdriverfile

MakeCert -r -pe -ss PrivateCertStore -n “CN=testdriver” testdriverfile.cer

  • Copy all the files to a  folder which includes the .sys file, the inf file and any coinstallers like wdfcoinstaller01009.dll etc.
  • Sign the driver sys file

SignTool sign /a /v /s PrivateCertStore /n testdriver /t  .\cat\pcifilter.sys

  • Generate the catalogue  file.

Inf2Cat /v /driver:\signing\cat /os:7_X64

  • Sign the cat fileSignTool sign /a /v /s PrivateCertStore /n testdriver /t .\cat\
    • Install the certificate    on the test machine

    Certutil -addstore -f “Trusted Root Certification Authorities” testdriver.cer

    Also run this command on the 64 bit system to allow test

    bcedit /set testsigning ON

Miscellaneous tidbits  about PCI express capabilities

  • Format is capability _ptr  followed by capability_id
  • In the initial 255     bytes of the PCI space it uses 8 bytes for capability_ptr and 8 for capability_id
  • PCI express extended capability     region – After that it uses  16 bytes
    for capability_id and then  1 byte for version and then 15 bytes for capability_ptr
  • Last cap has the capability_ptr     field set to 0
  • Following capability pointers
    • Check status register – 0x6 bit 0x10 for cap ptr
    • Register 0xe gives the      type of PCI device type like Bridge, endpoint etc