Driver signing versions as system is updated

W

Wod

Member
Hey guys, this is not really an NTLite matter so I've posted in general.

I noticed something, so specifically a memory card reader driver, it loads totally fine. After a while, after allowing the system to idle for a while and go into standby or after a restart. The stock Windows driver is being loaded in place of the Realtek driver, I assume because the system thinks that the Windows driver is newer due to the version signing ie 7.6.1.#### increase.

This is an issue for me because on both my machines I like to leave a memory card adapter fitted but on stock Windows driver, this leaves the DISK IO led permanently active where as the official Realtek driver doesn't.

What if drivers are slipped into the wim first, before any updates, would that perhaps solve the issue?

I wondered if I could resource edit the official driver to raise the version number but then I'm not sure if that would work as its not something I've ever tried doing or perhaps there is some registry setting to change the disk IO light to not be permanently lit?

Thanks guys
 
Wod first up we do not discuss modifying system files(ie hacking because this leaves us open to dmca takedown notices :/ ).
win-raid is your best option to ask/discuss modifying drivers and driver issues.

Before you do that try this,
windows power plans has a setting to enable/disable usb devices during idle, "disable usb devices" and going into sleep mode it kicks out my usb audio interface :mad:, "enable usb devices" setting stops that and keeps it "active"(for the want of a better word). Search Results.
Try that and report back :)
Next step would be to remove the stock ms driver and integrate the realtek one so the realtek driver is the only one availible.

Note - if the setting is hidden in Power Plans use MBK1969's Power Settings Explorer, it will show it and allow you to change it.
 
Last edited:
Clanger said:
Wod first up we do not discuss modifying system files(ie hacking because this leaves us open to dmca takedown notices :/ ).
win-raid is your best option to ask/discuss modifying drivers and driver issues.

Before you do that try this,
windows power plans has a setting to enable/disable usb devices during idle, "disable usb devices" and going into sleep mode it kicks out my usb audio interface :mad:, "enable usb devices" setting stops that and keeps it "active"(for the want of a better word). Search Results.
Try that and report back :)
Click to expand...
Hi Clanger, sorry about that, I wouldn't of thought it was classed as hacking more a manual update. In the same way that Microsoft seems to update it's version number falsely on its own drivers, ie the version number raises but in actual fact the driver has not changed from the original. Just simply wondering about manually applying Windows OS version to drivers in the same fashion, as in updating the coding order, may be the correct way to refer to it.

There's no power issues but stock Windows driver does keep this port powered as it thinks there's an actual SD car inside when it's merely an adapter, the problem is the annoying disk LED, I didn't know if for example the stock windows driver legally allows configuration via registry settings. With the official driver is I enable selective suspend, not only does the LED issue not exist when the port is powered up but the port can also power down correctly.

I was hoping that it I was to slip the drivers in before the updates then those drivers would automatically get their version number updated along the way, which would prevent Windows reloading it's stock driver? Because the official driver even carries just a generic Windows OS level tag and from what I can see that number tag not being updated while the stock windows drivers are, is what's causing the switching.

What I can do actually, is check the Realtek driver version number on my old original OS since that has been updated as time has gone by, if the version number has risen then I can go ahead and change the version number as more of a manual patch. It's not that I'd be fooling the system but just ensuring that coding order is updated as intended then.

I'll let you know what I find
 
Last edited:
Clanger said:
Wod first up we do not discuss modifying system files(ie hacking because this leaves us open to dmca takedown notices :/ ).
win-raid is your best option to ask/discuss modifying drivers and driver issues.

Before you do that try this,
windows power plans has a setting to enable/disable usb devices during idle, "disable usb devices" and going into sleep mode it kicks out my usb audio interface :mad:, "enable usb devices" setting stops that and keeps it "active"(for the want of a better word). Search Results.
Try that and report back :)
Next step would be to remove the stock ms driver and integrate the realtek one so the realtek driver is the only one availible.

Note - if the setting is hidden in Power Plans use MBK1969's Power Settings Explorer, it will show it and allow you to change it.
Click to expand...
Ok, So i think the switching comes about due to missing driver files

From the exe.inf:

"[RtsUStor.CopyList]
RtsUStor.sys

[RtsCopyFilesSection]
RtsUStor.dll

[RtsIconFileSection]
RtsUStoricon.dll"


I have checked the stock mentioned files against the ones already on host machine and they are identical. No harm in manually moving these original files from the driver folder and into the correct place in mount directory right? Do any security rights settings need tweaking or do I need to move files in CMD as Admin? Thankyou
 
The short answer is to disable drivers updates offered by WU. It is a known problem that WU's drivers can outrank drivers you may have installed, or prefer to be kept. This headache continues even today with W10/11, where you hear stories of disabled PC's because a different driver was installed w/o knowledge and the system was rebooted after monthly updates.

Driver ranking is done by a combination of driver release dates, and versioning. You can't hack the version since it's embedded inside the driver files and would break the digital signature. You can remove the Windows default driver from the image (if one exists), and turn off driver updates so no other driver can outrank your own.
 
garlin said:
The short answer is to disable drivers updates offered by WU. It is a known problem that WU's drivers can outrank drivers you may have installed, or prefer to be kept. This headache continues even today with W10/11, where you hear stories of disabled PC's because a different driver was installed w/o knowledge and the system was rebooted after monthly updates.

Driver ranking is done by a combination of driver release dates, and versioning. You can't hack the version since it's embedded inside the driver files and would break the digital signature. You can remove the Windows default driver from the image (if one exists), and turn off driver updates so no other driver can outrank your own.
Click to expand...
Rodger that, thanks for the input.

My attempt still failed after placing all driver files in the relevant locations so yeah. It seems the driver date is being ignored and that the priority is being placed based on tagged "Driver Version" which is bogus anyway. As the Windows driver file is still 2006 but after slipstream updates the claimed version number increases. The manufacturers driver is 2013 but being ignored because it's a lesser 6.1.7601.#### value. It's rather silly isn't it!

I may try repacking the driver files using SFX aswell as if I do manually launch the exe after, everything gets sorted but because it's not a compressed EXE (ie the installation files all sit around the EXE rather than inside of it) it'd be a waste of time to attach that as post install, atleast in it current state.

Cheers for your time ☺
 
Right, perhaps I've figured it out. So the associated driver files mentioned were place in DIR before save and export and that didn't seem to help. However, now that's done, when I do present the INF file, driver updater accepts it in. In theory, all I need to do now is re integrate the INF file in NTLite, this will work assuming that doing so will generate the reg edits found inside the INF?

I am not quite sure why this is the only driver being fussy but perhaps, because I had later on installed security quality roll ups, the previous reg entries had been deleted? Because when I tested my ISO at an earlier date it worked just fine. Since then I have added later security quality roll ups.

I suppose it is best practice to inject drivers at the final stages in some cases.

If not then I could just manually inject the required reg edits that I've captured instead.

If somebody could chime in on this part I'd appreciate it. Sorry to be bothersome, I'm a bit stuck in my own ways I know
 
When you add a driver to an image using extracted driver files, DISM or NTLite registers that driver to DriverStore. Unless it's registered in DriverStore, it won't be loaded at boot time. The driver package installer in Post-Setup does the same job, except it can only update a live system and not an offline image.

1. Load your image.
2. Check and remove any conflicting drivers that may be present.
3. Extract your preferred driver's installer files to a folder.
4. From NTLite's Drivers page, add this folder.
5. Make your image.
 
garlin said:
When you add a driver to an image using extracted driver files, DISM or NTLite registers that driver to DriverStore. Unless it's registered in DriverStore, it won't be loaded at boot time. The driver package installer in Post-Setup does the same job, except it can only update a live system and not an offline image.

1. Load your image.
2. Check and remove any conflicting drivers that may be present.
3. Extract your preferred driver's installer files to a folder.
4. From NTLite's Drivers page, add this folder.
5. Make your image.
Click to expand...
I don't wish to remove stock drivers as I want my ISO to be atleast as compatible with all machines as the original, that's why I'm shy about live capture.

Something has wiped the registry entry, the part which enumerates and overrides USBSTOR to RSUSBSTOR is all that the current problem is. I just wanted to know if injecting the INF once again via NTLite will re create those registry changes (the INF file contains said reg change instruction) , you've probably explained that and I simply can't comprehend the information. I imagine it will correct the issue now.

The driver was already pre injected but I've noticed that since updating with roll ups that said reg entry has vanished so it just needs putting back in
 
INF file only provides information about the driver. Unless you're manually picking a driver with Device Manager, it won't load the INF's referenced files if the reported version isn't newer that what's already been registered.

On general principle, Updates don't include driver updates with the notable exception of W7's rollup throwing in NVME support. The reason is because WU is supposed to find separate driver CAB's, so it can update PC's on a case by case basis.

We're also not talking about a live capture. Adding drivers from a folder means for NTLite to search a specific path for driver files to register inside DriverStore. You don't have to add anything that the host is using.

If you're concerned your driver is being "overwritten" then you should check the install image using DISM /get-drivers to see what's inside.
 
  • Like
Reactions: Wod
You must log in or register to reply here.
Back
Top