Windows – This driver has been blocked from loading (Windows 7)

driverswindows 7

I am learning to create device drivers for windows. Upon trying to deploy my first driver I encounter this error when I try to start the service:

System error 1275 has occurred.

This driver has been blocked from loading

I am using Windows Driver Kit Version 7.1.0. Tried to build the .sys file for /386 and /ia64 architectures. Tried to sign both files with a self-signed certificate. Finally disabled the signature checking (F8 during boot-up and selected "Disable Driver Signature Enforcement") and tried with both signed and unsigned driver. Still getting the same error.

Any ideas what could be done? The driver is being loaded by the service control manager but the error appears when I actually try to run net start MyDriver.

Update:
Signing is done using the command:
Signtool sign /v /s PrivateCertStore /n MyCert /t http://timestamp.verisign.com/scripts/timestamp.dll driver.sys i.e. I use an embedded signature. Also the MyCert certificate is from the Trusted Root Certification Authorities certificate repository (available certificates can be seen by executing Ctrl+R, certmgr.msc)

Best Answer

This error happens if you try to install a 32 bit driver on a 64 bit machine.

Related Solutions

How to digitally sign a 64-bit kernel mode driver

Yes, you need to purchase a certificate from a Trusted Certificate Authority. If anyone could make a certificate, there'd be countless certificates claiming to be "Microsoft Corporation" and it would be virus heaven.

That document you mention is what I used to learn how to sign drivers. I highly recommend you set aside a few days and run through it start to finish. I spent a good part of the week going through it.

All I can offer on top of that is the following batch file which I execute from VS2010 in post-build. It uses a certificate from the computer's certificate store, not a file. The reason it's so complex is I use it in many different circcumstances for many different projects.

Sign.bat

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Signs the project output.

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Usage
:: 
:: Post-build event command line:
:: Call "$(ProjectDir)..\..\Sign.bat" "$(ConfigurationName)" "$(TargetPath)"
:: 
:: Run the post-build event:
:: When the build updates the project output

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Input Parameters
:: 
:: %~1   $(ConfigurationName)    The file's configuration.  This function will
::                               use a different certificate for "Debug"
::                               configurations.
:: %~2   $(TargetPath)           The full path of the first file to sign.
:: %~3+  FileName                The names of the remaining files to sign.
::                               These files must reside in the same directory
::                               as %2.

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Validate the parameters.
If "%~1"=="Debug" Exit /B 0
If "%~1"=="" Goto Error
If "%~2"=="" Goto Error
Goto Valid

:Error
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Report that the syntax is incorrect.
Echo One or more parameters are missing.
Echo.
Echo %~nx0 configuration filename1 [filename2 ...]
Echo.
Echo configuration      The project configuration.  Usually "Debug" or "Release".
Echo filename1          The full path of the first file to sign.
Echo filename2          The names of addition files to sign.  These files must
Echo                    reside in the same folder as "filename1".
Echo.
Exit /B 1

:Valid
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Change to the assembly's folder.
%~d2
CD %~dp2

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Prepare the list of files to sign.
Set FileList=
:CreateFileList
Set FileList=%FileList% %~snx2
Shift /2
If Not "%~2"=="" Goto CreateFileList

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Sign the assembly files.
Set Store=my
Set Certificate=type the name of your certificate here
Set TimeStampUrl=http://timestamp.verisign.com/scripts/timestamp.dll
C:\WinDDK\7600.16385.1\bin\x86\SignTool.exe Sign /s "%Store%" /n "%Certificate%" /t "%TimeStampUrl%" %FileList%
If %ErrorLevel%==1 Exit /B 1

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Verify the digital signature is valid.
C:\WinDDK\7600.16385.1\bin\x86\SignTool.exe Verify /pa %FileList%

Windows – How to sign a Windows batch (.bat) file

I get a similar message if I run batch files (or other executables) from a network location. If this is the case, you may want to consider moving it to a local drive. Another alternative is to use a separate batch file on the local drive to launch the one on the network. The launching batch file need only have one line in it:

@call \\network\folder\batch.bat

Windows won't balk at the local file, and once that file is running, it can call the network version without issue.

Related Question