"inspect" Driver Sample Debug Version Start Failure, Windows Server Essential 2019

Question

I'm working with the WFP Windows Driver Sample "inspect":

 https://github.com/microsoft/Windows-driver-samples/tree/master/network/trans/inspect

I can run the driver (inspect.sys) on Windows 10 Pro with no issues, both Release and Debug versions.

I can also run the driver on "Windows Server Essentials 2019" with no issues in the Release version, but not in the Debug version. The attempt to start the Debug version driver fails as follows:

 C:\DriverTest\Drivers>sc start inspect
  [SC] StartService FAILED 87:
  The parameter is incorrect.

I tried the Debug version driver in two forms, both of which failed to start as shown above:

Form 1 - Runtime Library: Multi-threaded Debug DLL (/MDd)
Form 2 - Runtime Library: Multi-threaded Debug (MTd)

The computer setup is:

 Host:    Windows 10 Pro
 Target : Windows Server Essentials 2019 Virtual Machine running under Hyper-V on Host.

Any help you might provide in resolving this issue will be greatly appreciated.

Answer 1

The issue that caused my Debug build of the "inspect" driver to not start on my Windows Server Essentials 2019 has been found and fixed. The "inspect" package has the Project Property

Driver Settings/Driver Model/KMDF Version Minor (Target Version)

set to 'blank', for which the driver starts successfully. However, I changed the value to '31', which causes the driver to not start.

The value '31' is for the KMDF update dated May 2020, whereas my Windows Server Essentials 2019 is version 1809 dated 2018. So my driver was requiring a later KMDF version than was available on my server. Changing '31' back to 'blank' fixed the problem. Also, my Release build had the original value of 'blank' and had no issues starting.

Thanks for your help everyone.

Answer 2

Have you verified if the driver is loading and then failing (perhaps in DriverEntry) or not loading at all? Set a load image bp with the kernel debugger (sxe ld inspect.sys) or an unresolved breakpoint on driverentry (bu inspect!DriverEntry) and see if the bp hits. If it doesn't, next step is to look at the import tables in the working and not working images (link /dump /imports inspect.sys) and diff the results and evaluate what relevant differences are.