libusb0.sys snapshot release and digital signature #24

mcuee · 2021-10-19T02:11:17Z

(Updated on 13-Nov-2021)
Please take not libusb0.sys snapshot 1.2.7.1 release is not signed. Users who want to use it will have to get it signed by themselves. 1.2.7.2 snapshot release is signed but it will not work for Windows7.

Please help to test 1.2.7.3 to see if it works under Windows 7 or not.

V1.2.7.3 (11/13/2021) - SNAPSHOT RELEASE

driver: sign the drivers using SHA1 as well as SHA256
driver: sign the drivers after microsoft and not before (win7 fix)

V1.2.7.2 (10/25/2021) - SNAPSHOT RELEASE

driver: sign the drivers using EV certificate: libusb0.sys snapshot release and digital signature #24
driver: fix possible stack corruption: HPE team - found a stack override problem on libusb-win32 #19
lib: fix missing check for failed CloseHandle(): Bug: usb_free_async should check CloseHandle return value #12

V1.2.7.1 (09/18/2019) - SNAPSHOT RELEASE

Removed support for IA64
Removed support for W2K
Properly allocate NX pool memory on Win8+

V1.2.6.0 (01/17/2012)

Official release.
Removed ISO maximum transfer size restrictions/transfer splitting.
Fixed inf-wizard device notification issue.

dontech · 2021-10-19T09:18:27Z

Yeah, the binaries are not signed any more.

The problem is that the signature will be invalid the second someone changes the INF file.

The old way of signing is not supported any more due to

WIN10 only supports SHA256 AFAIK.
Only signing the SYS file is not supported any more, as the entire SYS/INF/CAT package needs to be signed AFAIK.

Please update me if I am missing something.

We could test-sign the releases, but it would still only work if you enable test-signing in target installation.

/pedro

dontech · 2021-10-19T09:19:00Z

We can of course fix the SHA256 requirement easily.

mcuee · 2021-10-20T13:18:23Z

Yeah, the binaries are not signed any more.

The problem is that the signature will be invalid the second someone changes the INF file.

Only signing the SYS file is not supported any more, as the entire SYS/INF/CAT package needs to be signed AFAIK.

Please update me if I am missing something.

@dontech

Actually we can get the sys signed and then people can use Zadig or libusbk-inf-wizard to install libusb0.sys based driver under Windows 7/8//8.1/10/11.
Ref: https://community.osr.com/discussion/293115/windows-11-and-alternative-driver-installation-method-in-libwdi#latest

How to get the signed .sys file?
You need a EV certificate to sign in the Microsoft portal, you still need to submit a full driver package, then you can throw away the other files, just keep the signed libusb0.sys files (eg: 32bit/64bit). Maybe we can keep the signed DLL files as well.

mcuee · 2021-10-20T13:20:29Z

Ref: my question was answered by Tim Roberts in OSR ntdev forum.
https://community.osr.com/discussion/comment/301698

On Wed, Jun 16, 2021 at 8:38 PM Xiaofan Chen wrote:

I understand that one needs an EV certificate.
https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/attestation-signing-a-kernel-driver-for-public-release

However, it is not clear to me how to submit a driver (.sys) file only
without an INF.

Previously we were able to use the code signing certificate to just
sign the .sys file
(libusb0.sys and liusbk.sys). Then users can use the following method to install
the driver packages under Windows 7/8/8.1/10. The method still works now.
https://github.com/pbatard/libwdi/wiki/Zadig
https://github.com/pbatard/libwdi/wiki/FAQ#What_are_these_USBVID_PID_MI__Autogenerated_certificates_that_libwdi_installs_in_the_Trusted_certificate_stores

Now assume we want to upgrade libusbk.sys and we get an EV certificate,
is it possible to just sign the libusbk.sys file? Or we can use a real
inf file and
then submit the inf file and libusbk.sys together for attestation signing, then
it will come back with a signed libusbk.sys driver?

libusbk:
https://github.com/mcuee/libusbk
(Note: we may want to discontinue libusbk.sys and contrate on WinUSB
support if the process is just too troublesome).

--
Xiaofan

Answer by Tim.
On Thu, Jun 17, 2021 at 2:11 AM Tim_Roberts wrote:

Tim_Roberts commented on Successful Windows 10 driver signing

You must have an INF, but it can be a fake INF, as long as it is syntactically correct and mentions all the DLLs you need. Microsoft signs all of the executable files included in the package. You can throw away the CAT file that comes back.

mcuee · 2021-10-20T13:30:10Z

Reference: low Windows driver rank score for libusbk as it is signed in Nov 2014. libusb0.sys 1.0.26 version was signed even earlier in Jan 2012.
https://github.com/pbatard/libwdi/wiki/Zadig#Preventing_the_replacement_of_a_Zadig_libusbK_USB_Device_Driver

For instance, Zadig's date stamp for libusbK might be 11/30/2014 for version 3.0.7.0 resulting in rank 00FF0001.

dontech · 2021-10-25T01:06:46Z

OK try this: https://sourceforge.net/projects/libusb-win32/files/libusb-win32-snapshots/20211025/

V1.2.7.2 (10/25/2021) - SNAPSHOT RELEASE

driver: sign the drivers using EV certificate: libusb0.sys snapshot release and digital signature #24
driver: fix possible stack corruption: HPE team - found a stack override problem on libusb-win32 #19
lib: fix missing check for failed CloseHandle(): Bug: usb_free_async should check CloseHandle return value #12

dontech · 2021-10-25T01:07:08Z

I signed it with my EV signature. Give it a spin.

mcuee · 2021-10-25T08:14:33Z

@dontech Great. Now it works. I have tested by using building Zadig to use the libusb-win32-1.2.7.2 snapshot binary.

Replaced the HID driver of a test device with libusb0.sys driver. Here is the output of test

C:\libusb-win32-1.2.7.2-bin\bin\amd64> .\testlibusb-win.exe

DLL version:	1.2.7.2
Driver version:	1.2.7.2

bus/device  idVendor/idProduct
bus-0/\\.\libusb0-0001--0x0925-0x7001     0925/7001
- Manufacturer : Lakeview Research
- Product      : Generic HID
bLength:             18
bDescriptorType:     01h
bcdUSB:              0200h
bDeviceClass:        00h
bDeviceSubClass:     00h
bDeviceProtocol:     00h
bMaxPacketSize0:     08h
idVendor:            0925h
idProduct:           7001h
bcdDevice:           0001h
iManufacturer:       1
iProduct:            2
iSerialNumber:       0
bNumConfigurations:  1
  wTotalLength:         41
  bNumInterfaces:       1
  bConfigurationValue:  1
  iConfiguration:       0
  bmAttributes:         c0h
  MaxPower:             50
    bInterfaceNumber:   0
    bAlternateSetting:  0
    bNumEndpoints:      2
    bInterfaceClass:    3
    bInterfaceSubClass: 0
    bInterfaceProtocol: 0
    iInterface:         0
      bEndpointAddress: 81h
      bmAttributes:     03h
      wMaxPacketSize:   64
      bInterval:        1
      bRefresh:         0
      bSynchAddress:    0
      bEndpointAddress: 01h
      bmAttributes:     03h
      wMaxPacketSize:   64
      bInterval:        1
      bRefresh:         0
      bSynchAddress:    0

mcuee · 2021-10-25T08:16:23Z

BTW, as mentioned in the Wiki, libusb-win32 inf-wizard does not work. So we probably want to remove it from the next releases.

Ref:
https://sourceforge.net/p/libusb-win32/wiki/Home/
https://github.com/mcuee/libusb-win32/wiki
The installer from libusb-win32 does not either under Windows 7/10, please use the GUI installer from libusbK or Zadig.

mcuee · 2021-10-25T08:17:58Z

I will close this one and create another ticket for the inf-wizard.

mcuee · 2021-10-25T08:33:41Z

For those who want to use the snapshot, you can use Zadig snapshot here.

https://sourceforge.net/projects/libusb-win32/files/Zadig_libwdi/
binary: zadig_git_99a38ae62ba0.exe
Source code: libwdi_git_src_99a38ae62ba0.zip

tormodvolden · 2021-10-27T12:19:59Z

Very nice. I appreciate the efforts you have put in here.

mcuee · 2021-10-29T14:01:00Z

I have to re-open this as it is said the driver package does not work with Windows 7 x64.

Ref: libusb/libusb#94 (comment)

mcuee · 2021-10-29T14:05:35Z

I tend to think this is because of the signing process. It will work under Windows 10 but not Windows 7,
Ref: https://community.osr.com/discussion/291262/driver-signing-on-windows-7-and-10

But I am not exactly sure about the issue or the solution. I am checking with the reported on the details (whether his Widows 7 machine has the necessary SHA-2 update). Maybe I have to ask in OSR forum again. The whole Windows driver signature issue is pretty complicated.

Official documentation from Microsoft.
https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-drivers-signed-by-microsoft-for-multiple-windows-versions

mcuee · 2021-10-29T14:14:17Z

One possibilty is that the user does not have the necessary SHA-2 update on the Windows 7 machine.
https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-drivers-signed-by-microsoft-for-multiple-windows-versions

mcuee · 2021-10-29T14:14:55Z

Or to make things easier, we should just drop Windows 7/8/8.1 support and only supports Windows 10/11 for the next official release, now that Windows 11 is released.

Take note personally I do not have any love of older unsupported (by Microsoft) version of Windows, including Windows 7. I myself run Windows 11 on my two home laptops and my work laptop runs Windows 10.

mcuee · 2021-10-29T14:23:14Z

@dontech You can decide the minum version which you feel comfortable to work with. Thanks.

mcuee · 2021-10-30T03:04:44Z

Still there is an easy workaround for Windows 7 as well if Zadig snapshot does not work for Windows 7.

Using Zadig 2.6 release to install libusb0.sys 1.2.6.0 device driver.
Using the libusb-win32 1.2.7.2 installer to upgrade libusb0.sys and libusb0.dll

mcuee · 2021-10-30T03:06:37Z

@dontech
@tormodvolden has a comment to see whether it is possible that you produce a signed release of the libusb 1.2.7.2 snapshot debug version with the debug info ON. I am not so sure about the Microsoft portal attestation signing policy with regard to debug version.

dontech · 2021-10-31T21:36:22Z

Hello all,

Yes, the attestation signing only works for win10. If we want full signing, we have to pass all the WHQL tests, which requires a larger test setup. I have done this before for clients, but it is super heavy. We could also find some bugs doing this, so it would not be a total waste.
Yeah i think we will include debug builds for the next release. No totally sure why "make dist" does not do this currently.

mcuee · 2021-11-02T02:38:03Z

Hello all,

Yes, the attestation signing only works for win10. If we want full signing, we have to pass all the WHQL tests, which requires a larger test setup. I have done this before for clients, but it is super heavy. We could also find some bugs doing this, so it would not be a total waste.

@dontech
If this can be done, that will be great. Take your time.

I assume that with WHQL it will work on Windows 7 onwards, including Windows 8/8.1 and Windows 10, as well as the corresponding Windows server versions.

Not so sure if we should even care for Windows XP and Windows Vista.

Yeah i think we will include debug builds for the next release. No totally sure why "make dist" does not do this currently.

That will be great.

mcuee · 2021-11-02T02:40:31Z

BTW, the following libusb issue fix does not seems to need the fix in 1.2.7.2.

Windows: libusb0.sys support improvement libusb/libusb#94

mcuee · 2021-11-10T14:23:13Z

New Zadig 2.7 build with libusb0.sys 1.2.7.2 snapshot release.
https://github.com/mcuee/libwdi/releases/tag/v1.4.1

I built Zadig 2.7 from libwdi 1.4.1 release source codes with VS2019 and tested it with Windows 10 and 11.
I am not so sure if it works under Windows 7/8/8.1. It will not work under Windows XP. Unlikely it will work under Windows Vista either. Please report your success or failure. Thanks.

changyp6 · 2021-11-11T08:50:40Z

New Zadig 2.7 build with libusb0.sys 1.2.7.2 snapshot release. https://github.com/mcuee/libwdi/releases/tag/v1.4.1

I built Zadig 2.7 from libwdi 1.4.1 release source codes with VS2019 and tested it with Windows 10 and 11. I am not so sure if it works under Windows 7/8/8.1. It will not work under Windows XP. Unlikely it will work under Windows Vista either. Please report your success or failure. Thanks.

I have tried this driver on Windows 7 SP1 (32 / 64) / Windows 8.1 Version 6.3 Build 9600 x86_64 / Windows 10

On both windows 8.1 and windows 10, libusb0.sys is reported "signed by libusb-win32"
On windows7, libusb0.sys is reported "not signed", in x86 Windows7, driver can be loaded and can work, however, in x86_64 Windows7, driver is refused to be loaded by system, and "Error Code 52" is reported in the device manager driver detail page.

libusb0.sys 1.2.7.2 still CANNOT work in Windows 7

mcuee · 2021-11-11T10:57:43Z

@changyp6 Thanks a lot for the report. This is kind of expected based on the report in libusb git issues discussions.

The best is now to go with WHQL so that it will also work on Windows 7 (with the SHA2 signature update). But that may take some time as per @dontech.

dontech · 2021-11-13T11:10:59Z

I have found a work-around:

https://community.osr.com/discussion/293107/now-that-cross-signing-is-deprecated-how-are-you-all-supporting-windows-7

The reason for this mess is the deprecation of cross-certs, and a specific bug in the windows 7 cert handling.

I will try to create a new snapshot with the certificate chain changes needed, and see if it helps...

dontech · 2021-11-13T12:14:02Z

OK new snapshot ready:

https://sourceforge.net/projects/libusb-win32/files/libusb-win32-snapshots/

changyp6, could you please try this and report back?
Additionally, it would be great if you also tried it on an older win7 install, to see if the SHA1 i added actually works. Not sure.

changyp6 · 2021-11-13T14:11:40Z

OK new snapshot ready:

https://sourceforge.net/projects/libusb-win32/files/libusb-win32-snapshots/
1. changyp6, could you please try this and report back?

2. Additionally, it would be great if you also tried it on an older win7 install, to see if the SHA1 i added actually works. Not sure.

I don't have test environment right now, so I'll try this new snapshot on next Monday, and give you feedback ASAP.

mcuee · 2021-11-13T14:38:02Z

@pazourek Please help to test 1.2.7.3 snapshot release under Windows 7 as well if you got the time. Thanks.

pazourek · 2021-11-13T15:54:26Z

I'm sorry, but I'm a little confused how to test the 1.2.7.3 snapshot. The version 1.2.7.2 contained an inf-wizard so I was able to install the driver. But the latest snapshot (libusb-win32-bin-1.2.7.3.zip) doesn't. There is also missing a .cat file.

mcuee · 2021-11-14T01:25:24Z

I'm sorry, but I'm a little confused how to test the 1.2.7.3 snapshot. The version 1.2.7.2 contained an inf-wizard so I was able to install the driver. But the latest snapshot (libusb-win32-bin-1.2.7.3.zip) doesn't. There is also missing a .cat file.

You can use Zadig to install libusb0.sys 1.2.6.0 driver for your device first, and then install libusb-win32 1.2.7.2 to upgrade the libusb0.sys and libusb0.dll file.

But I will create a release of Zadig 2.7 with the 1.2.7.3 snapshor release as well in a few hours.

mcuee · 2021-11-14T05:29:36Z

@pazourek
You can try my build of libwdi/Zadig here.
https://github.com/mcuee/libwdi/releases/tag/v1.4.1

mcuee · 2021-11-14T05:31:20Z

Mirror of libusb-win32 1.2.7.3 snapshot release here, I also include the above Zadig release.
https://github.com/mcuee/libusb-win32/releases/tag/snapshot_1.2.7.3

pazourek · 2021-11-15T04:08:20Z

The dirver installed by Zadig sems to work properly under Win7 Pro 64bit.

mcuee · 2021-11-15T04:11:48Z

The dirver installed by Zadig sems to work properly under Win7 Pro 64bit.

Great. Thanks for the confirmation.

changyp6 · 2021-11-15T08:00:34Z

Mirror of libusb-win32 1.2.7.3 snapshot release here, I also include the above Zadig release. https://github.com/mcuee/libusb-win32/releases/tag/snapshot_1.2.7.3

I have tested libusb0.sys 1.2.7.3 driver on Windows 7 SP1 (32 / 64) / Windows 8.1 Version 6.3 Build 9600 x86_64 / Windows 10 x86_64
libusb0.sys 1.2.7.3 can be loaded on both Windows 7 (32 / 64) and can work well, however, in the driver detailed info page, it still shows that "driver is not signed".
libusb0.sys 1.2.7.3 can be loaded on Windows 8.1 / Windows 10 x86_64, and can work well, in the driver detailed info page, it shows "driver is signed by libusb-win32"

dontech · 2021-11-15T09:51:00Z

libusb0.sys 1.2.7.3 can be loaded on both Windows 7 (32 / 64) and can work well, however, in the driver detailed info page, it >>still shows that "driver is not signed".

Yeah, i noticed the same. Any ideas?

It think it's because its attestation signed, which for some reason is not liked by the older Windows GUI.
Anyone know how to fix this?

Clearly the GUI is not driven by the same logic as the driver installer itself, at the installer approves of the driver now.
So i would say this went from a blocker to a minor.

dontech · 2021-11-15T10:28:40Z

It does the same for libusbk installed via Zadig.

I think this is something related to some Windows internals. Not sure this is fixable.
Also, it's purely cosmetic.

Maybe someone at libusbK knows more?

dontech · 2021-11-15T10:31:41Z

I think its because the GUI wants the driver to be cross signed by Microsoft.

Cross signing was removed and deprecated: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/deprecation-of-software-publisher-certificates-and-commercial-release-certificates

As long as the driver works, i think its OK. Ideas?

mcuee · 2021-11-15T10:49:53Z

I think its because the GUI wants the driver to be cross signed by Microsoft.

Cross signing was removed and deprecated: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/deprecation-of-software-publisher-certificates-and-commercial-release-certificates

As long as the driver works, i think its OK. Ideas?

Yes, I agree with your conclusion. We are more or less ready with the next release.

mcuee · 2021-11-15T11:01:05Z

For those who want to get the 'cosmetic' fixed, one way is to submit your driver package (for specific devices specified in the inf) for WHQL and hopefully it can pass the tests. You need to have the EV cert and you need to pass the HLK.
https://www.osr.com/blog/2020/10/15/microsoft-driver-updates-allowed-win7-win8/

mcuee · 2021-11-15T11:03:38Z

@dontech -- can you do another experiment with attestation signing?

You have used the Option 1 in the following OSR forum post. The package will work under Windows 10. Now you may want to try Option2. This time you do not use your cert to sign the package. It is said that the result package will be working under Windows 7 and Windows 10.

Ref:
https://community.osr.com/discussion/292832/cross-signing-certs-expiring-this-week-how-will-whql-work
https://www.osr.com/blog/2021/04/08/lost-cause-no-driver-updates-allowed-except-for-win-10/

Peter_Viscarola_(OSR) Administrator
...

You have one or more cert that are registered with the dashboard. Sign everything with one of those certs, including your driver package, when you submit it for Attestation Signing. No cross-signing. The Attestation Signed package will install only on Win 10.

OR

Don’t sign the drivers, and the package will be installable on Win 7 and Win 10.

Done. No need to ask MSFT anything,

dontech · 2021-11-17T00:22:34Z

I tried not signing anything. Same thing: loads on win7 x64, but still states "not signed in GUI".

Fairly sure this is an O/S limitation we cannot get around, which was caused by the expiration of the cross-certs, which win7 GUI apparently wants. Either that or it wants an MS SHA1 signature, which the signing portal does not provide. To fix that Microsoft would need to push a fix for WIN7. Since WIN7 is EOL thats doubtful.

I think we a stuck with the current solution, unless someone can point to someone who has gotten around this.

mcuee · 2021-11-17T00:42:48Z

Good. Thanks for the confirmation. I will close this issue now.

mcuee added the release label Oct 19, 2021

dontech mentioned this issue Oct 19, 2021

libusb-win32 new snapshot release #23

Closed

mcuee closed this as completed Oct 25, 2021

This was referenced Oct 25, 2021

Potential issue of libusbk.sys mcuee/libusbk#32

Open

Cannot send libusb_control_transfer with zero wLength for libusb0.sys libusb/libusb#1006

Closed

mcuee reopened this Oct 29, 2021

mcuee mentioned this issue Oct 30, 2021

Windows: libusb0.sys support improvement libusb/libusb#94

Closed

mcuee added the enhancement label Nov 11, 2021

mcuee changed the title ~~Info: libusb0.sys snapshot release is not signed~~ libusb0.sys snapshot release and digital signature Nov 11, 2021

mcuee mentioned this issue Nov 11, 2021

libusb_get_string_descriptor_ascii() returns always LIBUSB_ERROR_NOT_FOUND -- libusb0.sys only libusb/libusb#761

Closed

mcuee mentioned this issue Nov 16, 2021

Release plan discussion #26

Open

mcuee closed this as completed Nov 17, 2021

libusb0.sys snapshot release and digital signature #24

libusb0.sys snapshot release and digital signature #24

Comments

mcuee commented Oct 19, 2021 • edited Loading

V1.2.7.3 (11/13/2021) - SNAPSHOT RELEASE

V1.2.7.2 (10/25/2021) - SNAPSHOT RELEASE

V1.2.7.1 (09/18/2019) - SNAPSHOT RELEASE

V1.2.6.0 (01/17/2012)

dontech commented Oct 19, 2021

dontech commented Oct 19, 2021

mcuee commented Oct 20, 2021 • edited Loading

mcuee commented Oct 20, 2021

mcuee commented Oct 20, 2021

dontech commented Oct 25, 2021 • edited by mcuee Loading

V1.2.7.2 (10/25/2021) - SNAPSHOT RELEASE

dontech commented Oct 25, 2021

mcuee commented Oct 25, 2021

mcuee commented Oct 25, 2021 • edited Loading

mcuee commented Oct 25, 2021

mcuee commented Oct 25, 2021

tormodvolden commented Oct 27, 2021

mcuee commented Oct 29, 2021

mcuee commented Oct 29, 2021 • edited Loading

mcuee commented Oct 29, 2021

mcuee commented Oct 29, 2021 • edited Loading

mcuee commented Oct 29, 2021

mcuee commented Oct 30, 2021

mcuee commented Oct 30, 2021

dontech commented Oct 31, 2021

mcuee commented Nov 2, 2021 • edited Loading

mcuee commented Nov 2, 2021

mcuee commented Nov 10, 2021

changyp6 commented Nov 11, 2021

mcuee commented Nov 11, 2021 • edited Loading

dontech commented Nov 13, 2021 • edited Loading

dontech commented Nov 13, 2021

changyp6 commented Nov 13, 2021

mcuee commented Nov 13, 2021

pazourek commented Nov 13, 2021

mcuee commented Nov 14, 2021

mcuee commented Nov 14, 2021

mcuee commented Nov 14, 2021

pazourek commented Nov 15, 2021

mcuee commented Nov 15, 2021

changyp6 commented Nov 15, 2021

dontech commented Nov 15, 2021

dontech commented Nov 15, 2021

dontech commented Nov 15, 2021

mcuee commented Nov 15, 2021

mcuee commented Nov 15, 2021 • edited Loading

mcuee commented Nov 15, 2021 • edited Loading

dontech commented Nov 17, 2021

mcuee commented Nov 17, 2021

mcuee commented Oct 19, 2021 •

edited

Loading

mcuee commented Oct 20, 2021 •

edited

Loading

dontech commented Oct 25, 2021 •

edited by mcuee

Loading

mcuee commented Oct 25, 2021 •

edited

Loading

mcuee commented Oct 29, 2021 •

edited

Loading

mcuee commented Oct 29, 2021 •

edited

Loading

mcuee commented Nov 2, 2021 •

edited

Loading

mcuee commented Nov 11, 2021 •

edited

Loading

dontech commented Nov 13, 2021 •

edited

Loading

mcuee commented Nov 15, 2021 •

edited

Loading

mcuee commented Nov 15, 2021 •

edited

Loading