We recently switched to DiInstallDriver and DiUninstallDriver APIs for our kernel driver's installation/uninstallation via MSI. I encounter no issues when using DiInstallDriver to install the driver. It successfully copies the driver to the DriverStore and creates the necessary RegKeys and Service. However, DiUninstallDriver does not work as intended. Although the driver is removed from the DriverStore, the RegKeys and Service are not removed from the registry.
Am I missing something in the call to DiUninstallDriver or in the INF file?
Below driver traces remain in the registry:
Computer\HKEY_LOCALMACHINE\SYSTEM\ControlSet001\Services\mydriver
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mydriver
Also "sc query mydriver" shows driver in STOPPED state which is not correct.
Below is the MS page that recommends that we switch to DiInstallDriver and DiUninstallDriver APIs for the driver installation and uninstallation.
https://learn.microsoft.com/en-us/windows-hardware/drivers/install/difx-guidelines
Below is the INF file I am using:
[Version]
Signature = "$Windows NT$"
Class = MYDRIVER
ClassGuid = {00F8631E-F7E7-477e-B0AE-748C1915CEDE}
Provider = %Manufacturer%
DriverVer = 08/10/2023,15.8.00400.00004
CatalogFile = mydriver.cat
DriverPackageType = KernelService
[DestinationDirs]
DefaultDestDir = 12
Section.DriverFiles = 12 ;%windir%\\system32\\drivers
;;
;; Default install sections
;;
;x64 install
[DefaultInstall.NTAMD64]
OptionDesc = %ServiceDescription%
CopyFiles = Section.DriverFiles
[DefaultInstall.NTAMD64.Services]
AddService = %ServiceName%,,Section.Service,Section.Eventlog
;;
;; Default uninstall sections
;;
;x64 uninstall
[DefaultUninstall.NTAMD64]
DelFiles = Section.DriverFiles
LegacyUninstall=1
[DefaultUninstall.NTAMD64.Services]
DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting
[SourceDisksFiles]
mydriver.sys = 1
[SourceDisksNames]
1 = %Disk1%
;
; Services Section
;
[Section.Service]
DisplayName = %ServiceName%
Description = %ServiceDescription%
ServiceBinary = %12%\\%ServiceName%.sys ;%windir%\\system32\\drivers\\
ServiceType = 1 ;SERVICE_FILE_SYSTEM_DRIVER
StartType = 3 ;SERVICE_DEMAND_START
ErrorControl = 1 ;SERVICE_ERROR_NORMAL
AddReg = Section.AddRegistry;,Section.Eventlog.AddRegistry
;
; Registry Modifications
;
[Section.AddRegistry]
HKR,%RegInstancesSubkeyName%,%RegDefaultInstanceValueName%,0x00000000,%DefaultInstance.Name%
HKR,%RegInstancesSubkeyName%"\\"%DefaultInstance.Name%,%RegFlagsValueName%,0x00010001,%DefaultInstance.Flags%
[Section.Eventlog]
AddReg = Section.Eventlog.AddRegistry
[Section.Eventlog.AddRegistry]
;HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\\Sytem32\\IoLogMsg.dll;%%SystemRoot%%\\System32\\drivers\\mydriver.sys"
;HKR,,TypesSupported,0x00010001,7
;
; Copy Files
;
[Section.DriverFiles]
mydriver.sys
;;
;; String Section
;;
[Strings]
Manufacturer = "Xyz"
ServiceName = "mydriver"
ServiceDescription = "Real Time Application Monitor"
RegInstancesSubkeyName = "Instances"
RegDefaultInstanceValueName = "DefaultInstance"
RegFlagsValueName = "Flags"
Disk1 = "MYDRIVER Source Media"
;Instances specific information.
DefaultInstance.Name = "Default"
DefaultInstance.Flags = 0x0 ; Suppress automatic attachments