I am trying to use InstallHinfSection API for the kernel driver's installation/uninstallation on Win10. I encounter no issues when using it to install the driver. It successfully copies the driver to the DriverStore and creates the necessary RegKeys and Service. However, it does not work as intended during uninstallation. Although the driver is removed from the DriverStore, the RegKeys and Service are not removed from the registry. After uninstallation, "sc query mydriver" shows driver in STOPPED state which is not correct.
Am I missing something in the call to InstallHinfSection or in the INF file?
Below driver traces remain in the registry:
Computer\HKEY_LOCALMACHINE\SYSTEM\ControlSet001\Services\mydriver
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mydriver
Command for installation:
RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\mydriver.inf
Command for uninstallation:
RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 C:\mydriver.inf
Below is the INF file I am using:
[Version]
Signature = "$Windows NT$"
Class = MYDRIVER
ClassGuid = {00F8631E-F7E7-477e-B0AE-748C1915CEDE}
Provider = %Manufacturer%
DriverVer = 08/10/2023,15.8.00400.00004
CatalogFile = mydriver.cat
DriverPackageType = KernelService
[DestinationDirs]
DefaultDestDir = 12
Section.DriverFiles = 12 ;%windir%\\system32\\drivers
;;
;; Default install sections
;;
;x64 install
[DefaultInstall.NTAMD64]
OptionDesc = %ServiceDescription%
CopyFiles = Section.DriverFiles
[DefaultInstall.NTAMD64.Services]
AddService = %ServiceName%,,Section.Service,Section.Eventlog
;;
;; Default uninstall sections
;;
;x64 uninstall
[DefaultUninstall.NTAMD64]
DelFiles = Section.DriverFiles
LegacyUninstall=1
[DefaultUninstall.NTAMD64.Services]
DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting
[SourceDisksFiles]
mydriver.sys = 1
[SourceDisksNames]
1 = %Disk1%
;
; Services Section
;
[Section.Service]
DisplayName = %ServiceName%
Description = %ServiceDescription%
ServiceBinary = %12%\\%ServiceName%.sys ;%windir%\\system32\\drivers\\
ServiceType = 1 ;SERVICE_FILE_SYSTEM_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1 ;SERVICE_ERROR_NORMAL
AddReg = Section.AddRegistry;,Section.Eventlog.AddRegistry
;
; Registry Modifications
;
[Section.AddRegistry]
HKR,%RegInstancesSubkeyName%,%RegDefaultInstanceValueName%,0x00000000,%DefaultInstance.Name%
HKR,%RegInstancesSubkeyName%"\\"%DefaultInstance.Name%,%RegFlagsValueName%,0x00010001,%DefaultInstance.Flags%
[Section.Eventlog]
AddReg = Section.Eventlog.AddRegistry
[Section.Eventlog.AddRegistry]
;HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\\Sytem32\\IoLogMsg.dll;%%SystemRoot%%\\System32\\drivers\\mydriver.sys"
;HKR,,TypesSupported,0x00010001,7
;
; Copy Files
;
[Section.DriverFiles]
mydriver.sys
;;
;; String Section
;;
[Strings]
Manufacturer = "Xyz"
ServiceName = "mydriver"
ServiceDescription = "Real Time Application Monitor"
RegInstancesSubkeyName = "Instances"
RegDefaultInstanceValueName = "DefaultInstance"
RegFlagsValueName = "Flags"
Disk1 = "MYDRIVER Source Media"
;Instances specific information.
DefaultInstance.Name = "Default"
DefaultInstance.Flags = 0x0 ; Suppress automatic attachments