In addition to getting the tooling installed for driver development on Windows 10 1903 I have also included instructions for getting up and running with the
Windows Filtering Platform sample Inspect
which is a sample callout driver for doing packet inspection.
The first step is to install the Windows 10 SDK. This is required to build the drivers and needs to match the version of the WDK that you will install in the next step.
- Navigate to Windows 10 SDK Download Page
- Click on
Download The Installer
- Run the file
- Select
Install the Windows Software Development Kit - ...
and clickNext
- Opt in/out of the data usage and click
next
- Read and
Accept
the agreement - Uncheck the features you don't want then click
Next
The install will take a while depending on your system. Once it is finished click close
- Navigate to Widows 10 WDK Download Page
- Scroll down to step 2 and click on
Download WDK for Windows 10, version 1903
- Run the file
- Select
Install the Windows Driver Kit - ...
and clickNext
- Opt in/out of the data usage and click
next
- Read and
Accept
the agreement - Allow the UAC Elevation
- Install will take a while again...
- After the install finishes leave
Install Windows Driver Kit Visual Studio extension
checked and clickClose
- Once the extension installer starts check the versions of Visual Studio you want to install the extension on and click
Install
You may need to close any open Visual Studio Windows - Once finished click
close
- Navigate to Windows Filtering Platform Sample Page
- Click blue button
Download ZIP
- Open the file and extract the contents to somewhere on your disk
- Navigate to that location and open the file
inspect.sln
- If prompted for Visual Studio version select Visual Studio 2019.
- I recommend making the
README.md
file available inside VS. To do this right click on the solution and clickAdd -> Existing Item
then browse and selectREADME.md
. Now you should see README.md listed underSolution Items
.
Once you have finished installing everything you should have a project open with the inspect sample in it. The first step is to see if the project will build. Most likely you need to make some changes before it will.
- Right click on the inspect project and click on
properties
- Click on
Driver Settings
- Change
Target Platform
from Universal to Desktop - Once that is done click
ctrl-b
or go toBuild -> Build inspect
and the project should build properly.
- Install or Clone an existing Virtual Machine running Windows 10
- If the system needs to be updated to 1903 follow these steps.
- Navigate to Windows 10 Site and selecting the
Update now
button. - Once the download finishes run the Windows10Upgrade9252.exe
- Click
Update Now
- If checks pass click
Next
- Wait for the update to finish and reboot
- On your local system (the one with the WDK installed) navigate to
C:\Program Files (x86)\Windows Kits\10\Remote\x64
and copy the fileWDK Test Target Setup x64-x64_en-us.msi
then paste/copy it to your virtual machine - Run the
WDK Test Target Setup x64-x64_en-us.msi
- Open up the firewall by going to
System and Security -> Windows Firewall -> Advanced Settings -> Inbound Rules
. Enable allNetwork Discovery
rules, on each ruledouble click
and go to thescope
tab and underRemote IP address
selectAny IP address
- Locate the
File and Printer Sharing
rules and double click and go to thescope
tab and underRemote IP Address
selectAny IP address
- Back on your development machine click
x86
on the toolbar in Visual Studio and change tox64
. Then right click the projectinspect
and selectproperties
- Go to
Driver Install
then toDeployment
and selectConfigure Devices
from the drop down - Enter
Remote Debug VM
for the Display name - Enter the IP adress for the network name
- Click
next
and leave defaults continue until the install starts. - Click
Finish
after install is complete (if it gives an error about setting a restore point it will still work) - Click
OK
to close out the properties window - Right click on the project and select
properties
again and go toDriver Settings
and clickGeneral
and make sure the target platform is set toDesktop
- Build solution with
ctrl-shift-b
- Right click on the project
inspect
and selectDeploy
- Navigate to
C:\DriverTest\Drivers
on the debug VM and you should see your driver files - Enable debug printing on the target VM. Add a key to the registery called
Debug Print Filter
underHKLM\System\CurrentControlSet\Control\Session\Manager
then add a DWORD namedDEFAULT
and set the value to8
- Disable signing on the VM. Open a elevated command prompt and run the command
bcdedit /set testsigning on
- Reboot the test system
- Inside
C:\DriverTest\Drivers
on the VM right click oninspect.inf
and clickInstall
and selectYes
on the UAC prompt - Open the registery editor on the test system and go to
HKLM\System\CurrentControlSet\Services\inspect\Parameters
- Create the following keys
REG_DWORD
namedBlockTraffic
and set it to0
to permit or1
to blockREG_SZ
namedRemoteAddressToInspect
and set it to the IPv4 or IPv6 address (example10.0.0.1
)
- Open an administrative command prompt and start the driver
net start inspect
- To stop use
net stop inspect
You should have seen the message that The Inspect service was started successfully.
All is working now