Unsigned Drivers in 64-Bits

Electronics is as a hobby of mine. Nothing fancy, just some PIC programming. Of course to program them one needs PIC programmer. If you combine that with me being cheap bastard and wanting USB connection you get MCUmall’s USB PIC programmer which is nice little device for a very low price. Internally it is serial port programmer and it interfaces USB using very popular Prolific PL-2303 chip. I even found 64-bit driver for it. Sure, it was 64-bit XP driver but I didn’t saw any problem with that, driver model for serial ports is same in both XP and Vista.

64-bit paranoia

If you cannot find Vista driver for your serial device, installing XP one works like a charm. That is if you are using 32-bit Windows Vista. If you are using 64-bit version you may have a problem. Microsoft decided to require every driver for 64-bit version to be signed in order to be loaded in kernel space. I personally think that driver signing is not a bad idea - warn user that driver is not signed and let him decide whether he really wants that installed. On 64-bit version they took it one step further. Windows Vista (x64) will warn user, it will even let user decide that it is ok to install driver but after installing driver it will just ignore user’s request and prevent driver from loading. After you deduce that problem is not driver itself but its signature (or lack of it), you may try to find way to go around it on Internet.

What does not work?

First thing that looked promising to me is just setting DDISABLE_INTEGRITY_CHECKS (no, double d is not an error) option to loader. Next time Windows boots up, it will just disable signature checking and thus load your driver. This was great solution, but it doesn’t work for quite a while now. You may try to re-activate it by uninstalling some hot-fixes which may have been practical when there was only one to remove but there are quite a few of them that break that option now - including SP1. Removing all of them and running half-patched system (some other hot-fixes are dependent on them) is just asking for trouble. Just remember how nice Vista was before SP1 and you will quickly abandon this option.

Here I should mention setting of nointegritychecks option. Last time that this worked was while Windows Vista was still in beta.

What does work (but not in nice way)

One can always test-sign his drivers and set bcdedit testsigning option. After reboot, your driver just works. Only thing that is preventing happiness is “Test mode” written in all four corners of your desktop. You may remove it by changing resource files but I would rather have “Test mode” in all four corners than make a change which will invalidate file’s check-sum and possibly make some update in future to fail.

How Microsoft thinks we should do it?

On reboot press F8 and there is option to allow unsigned drivers. This works great except one small detail - you need to do it on every reboot. Currently there is no way to force it on but one can always hope for a brighter future. I personally use this mode since I don’t play with electronics too often and I rarely reboot my computer anyway.

Professional solution

Real solution would be to sign the drivers. If we ignore possible legal troubles of this act and we even find really nice guide on how to do it, there is still problem that you cannot just use any certificate. Your certificate needs to be one of few selected roots for which Microsoft gives cross-certificate. My cheap Comodo certificate which I normally use for getting “nice” UAC prompts (since it is recognized as trusted root by Vista) is quite useless for this particular purpose.

One solution that I had was annoying one MVP (he shall be unnamed since I am not quite sure that what follows is legal) and get him to download huge Windows Driver Kit and sign everything. If you are wondering why I thought that I should bother MVP - they get discounted GlobalSign certificate through their MVP gig. Although both of us consider ourself to be smart guys which are quite able to follow few steps, we didn’t have any success. Driver was signed, everything looked like it should except for the fact that Vista still refused to load drivers. We will probably try to do this one more time - both of us really hate unsolved misteries - but for now I must acknowledge defeat.

[2010-02-15: I just noticed - drivers for Windows 7 are finally available.]

[2010-07-12: Although drivers were available they didn’t work with my board. However, I found drivers that do work.]