内核驱动签名
我已经做了很多环顾四周，但似乎无法得到这个问题的直接答案。
我是一名业余程序员，我对 Windows 驱动程序进行了大量工作，并为 Windows XP 编写了我自己的个人“防病毒”驱动程序。所以请不要误会我的意思，我不为任何软件开发公司或类似的公司工作。
我的问题是：就 Windows 7 x64 而言，是否有任何可能的合法且合法方法可以用来发布签名我的驱动程序，该驱动程序仅供我个人使用？
是的，我很清楚我可以测试签名我的驱动程序并在 Windows 测试模式下在虚拟机中运行它，我经常这样做。但是，如果您在测试模式下使用过 Windows，您就会知道 Windows 存在一些主要缺点。
总而言之，我（一个业余爱好者）是否可以发布一个驱动程序供我个人使用，而不必处理 Windows 测试模式？
谢谢。
I have done a great deal of looking around, and I can't seem to get a straightforward answer to this issue.
I am hobbyist programmer, I have done a great deal of work with windows drivers, and wrote my own personal 'antivirus' driver for windows XP. So don't get me wrong here, I don't work for any software development firm or anything of the like.
My question is: as far as windows 7 x64 is concerned, is there any possible legit and legal method I can use to release sign my driver that would only be for my own personal use?
Yes I am well aware I can test sign my driver and run it in a virtual machine under windows test mode, which I do quite frequently. However if you have used windows in test mode you know there are some major drawbacks.
So to to sum this all up, is it possible for me ( a hobbyist ) to release sign a driver for my own personal use and not have to deal with windows test mode?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果它是一个需要启动时间的驱动程序，我认为没有办法可以在不使用 Microsoft 认可的提供商的证书对其进行签名的情况下使用它（我认为仅适用于驱动程序的 Verisign？）。
如果这是启动时不需要的普通设备驱动程序，您可以创建自己的证书并使用它们。我自己为 Vista x64 做了此操作，通过对 .sys 和 .inf 文件进行签名，使 HP ScanJet 驱动程序能够在 XP x64 上运行。
我在域中使用 Active Directory 证书服务来颁发代码签名证书供我使用，并让我的计算机信任 ADCS CA 证书。这两个操作将使 Windows 信任您的签名驱动程序。
我相信您可以使用 OpenSSL 创建 CA 证书并用其颁发代码签名证书，但我没有使用它的实践。
再次重申，如果启动时需要此驱动程序，则此方法将不起作用，如果它用于可以随时连接的设备，则它应该起作用。
If it's a boot time required driver, I don't think there is a way you can get it to use it without signing it with a certificate from a Microsoft sanctioned provider (Verisign only I think for drivers?).
If this is a normal device driver that isn't required at boot you can create your own certificates and use those instead. I did it myself for Vista x64 to get an HP ScanJet driver to work from XP x64 by signing the .sys and the .inf files.
I used Active Directory Certificate Services on my domain to issue a Code Signing certificate for my use and had my machine trust the ADCS CA certificate. These two actions will cause Windows to trust your signed driver.
I believe you could use OpenSSL to create a CA certificate and issue code signing certificates with that, but I've had no practice with it.
Again, to reiterate, if this driver is required at boot then this method will not work, if it's used for a device which can be attached at anytime, it should work.
您可以让 ReactOS 基金会 为您做这件事。
请参阅我对这篇文章的答案：Windows 7 内核驱动程序签名。
You can have the ReactOS Foundation do it for you.
Please refer to my answer to this post: Windows 7 kernel driver signing.
是的。
对于启动时驱动程序：转到 VeriSign，购买（唯一？）代码签名证书（500 美元），然后对您的驱动程序进行签名。
对于非启动驱动程序：您可以自签名，并带有适当的警告。
Yes.
For boot time drivers: Go to VeriSign, buy the (only?) code signing certificate ($500), and sign your driver.
For non-boot drivers: You can self-sign, with appropriate warnings.