Installing Toolchain For Driver Development

In addition to getting the tooling installed for driver development on Windows 10 1903 I have also included instructions for getting up and running with the Windows Filtering Platform sample Inspect which is a sample callout driver for doing packet inspection.

Install the Windows 10 SDK

The first step is to install the Windows 10 SDK. This is required to build the drivers and needs to match the version of the WDK that you will install in the next step.

1. Navigate to Windows 10 SDK Download Page
2. Click on Download The Installer
3. Run the file
4. Select Install the Windows Software Development Kit - ... and click Next
5. Opt in/out of the data usage and click next
6. Read and Accept the agreement
7. Uncheck the features you don't want then click Next

The install will take a while depending on your system. Once it is finished click close

Install the Windows 10 1903 WDK

1. Navigate to Widows 10 WDK Download Page
2. Scroll down to step 2 and click on Download WDK for Windows 10, version 1903
3. Run the file
4. Select Install the Windows Driver Kit - ... and click Next
5. Opt in/out of the data usage and click next
6. Read and Accept the agreement
7. Allow the UAC Elevation
8. Install will take a while again...
9. After the install finishes leave Install Windows Driver Kit Visual Studio extension checked and click Close
10. Once the extension installer starts check the versions of Visual Studio you want to install the extension on and click Install You may need to close any open Visual Studio Windows
11. Once finished click close

Installing Windows Filtering Platform Sample

1. Navigate to Windows Filtering Platform Sample Page
2. Click blue button Download ZIP
3. Open the file and extract the contents to somewhere on your disk
4. Navigate to that location and open the file inspect.sln
5. If prompted for Visual Studio version select Visual Studio 2019.
6. I recommend making the README.md file available inside VS. To do this right click on the solution and click Add -> Existing Item then browse and select README.md. Now you should see README.md listed under Solution Items.

Building the project

Once you have finished installing everything you should have a project open with the inspect sample in it. The first step is to see if the project will build. Most likely you need to make some changes before it will.

1. Right click on the inspect project and click on properties
2. Click on Driver Settings
3. Change Target Platform from Universal to Desktop
4. Once that is done click ctrl-b or go to Build -> Build inspect and the project should build properly.

Setting up a remote deployment host to test on

1. Install or Clone an existing Virtual Machine running Windows 10
2. If the system needs to be updated to 1903 follow these steps.

• Navigate to Windows 10 Site and selecting the Update now button.
• Once the download finishes run the Windows10Upgrade9252.exe
• Click Update Now
• If checks pass click Next
• Wait for the update to finish and reboot

3. On your local system (the one with the WDK installed) navigate to C:\Program Files (x86)\Windows Kits\10\Remote\x64 and copy the file WDK Test Target Setup x64-x64_en-us.msi then paste/copy it to your virtual machine
4. Run the WDK Test Target Setup x64-x64_en-us.msi
5. Open up the firewall by going to System and Security -> Windows Firewall -> Advanced Settings -> Inbound Rules. Enable all Network Discovery rules, on each rule double click and go to the scope tab and under Remote IP address select Any IP address
6. Locate the File and Printer Sharing rules and double click and go to the scope tab and under Remote IP Address select Any IP address
7. Back on your development machine click x86 on the toolbar in Visual Studio and change to x64. Then right click the project inspect and select properties
8. Go to Driver Install then to Deployment and select Configure Devices from the drop down
9. Enter Remote Debug VM for the Display name
10. Enter the IP adress for the network name
11. Click next and leave defaults continue until the install starts.
12. Click Finish after install is complete (if it gives an error about setting a restore point it will still work)
13. Click OK to close out the properties window
14. Right click on the project and select properties again and go to Driver Settings and click General and make sure the target platform is set to Desktop
15. Build solution with ctrl-shift-b
16. Right click on the project inspect and select Deploy
17. Navigate to C:\DriverTest\Drivers on the debug VM and you should see your driver files
18. Enable debug printing on the target VM. Add a key to the registery called Debug Print Filter under HKLM\System\CurrentControlSet\Control\Session\Manager then add a DWORD named DEFAULT and set the value to 8
19. Disable signing on the VM. Open a elevated command prompt and run the command bcdedit /set testsigning on
20. Reboot the test system

Testing the driver

1. Inside C:\DriverTest\Drivers on the VM right click on inspect.inf and click Install and select Yes on the UAC prompt
2. Open the registery editor on the test system and go to HKLM\System\CurrentControlSet\Services\inspect\Parameters
3. Create the following keys

• REG_DWORD named BlockTraffic and set it to 0 to permit or 1 to block
• REG_SZ named RemoteAddressToInspect and set it to the IPv4 or IPv6 address (example 10.0.0.1)

4. Open an administrative command prompt and start the driver net start inspect
5. To stop use net stop inspect

You should have seen the message that The Inspect service was started successfully. All is working now