For Your PC Only Filter Driver Experiment

I. Background:

A filter driver is a Microsoft Windows driver that adds value to peripheral devices or supports a specialized device in the personal computer. Written either by Microsoft or the vendor of the hardware, any number of filter drivers can be added to Windows. Upper level filter drivers sit above the primary driver for the device (the function driver), while lower level filter drivers sit below the function driver and above the bus driver.

II. USB Filter Drivers:

One of the purposes of developing a USB upper filter driver is to intercept and examine the data passed between the Host computer and the Device. Once intercepted, the data can be recorded and /or manipulated for certain applications.

There is a sample USB Filter Driver provided by Microsoft Windows DDK. You can build and use it as the base for the experiment. Let's say the file is called Filter.sys and you put to c:\windows\system32\drivers.

To install a USB Filter Driver, you will need an INF file. The following INF is an example to install Filter.sys as a upper filter driver of a USB driver USBCCGP.SYS

; This .INF file demonstrates how to install a filter driver
; for a USB device.
;
; The lines marked with the comment "Filter driver install"
; identify those lines that were specifically added in order to install
; the upper filter driver onto the "driver stack" for this USB device
;
; If one were to remove these lines, what remains is the original
; .INF file to install just the one driver for the USB device.
;

[Version]
Signature="$WINDOWS NT$"
Class=USB
ClassGUID={36FC9E60-C465-11CF-8056-444553540000}

[Manufacturer]
%MfgName%=MyDriver

[MyDriver]
%USB\VID_0D8C&PID_000E.DeviceDesc%=USBCCGP.Dev, USB\VID_0D8C&PID_000E

[DestinationDirs]
USBCCGP.Files.Ext = 10,System32\Drivers

[USBCCGP.Dev.NT]
CopyFiles=USBCCGP.Files.Ext

[USBCCGP.Files.Ext]
USBCCGP.SYS
FILTER.SYS                                   ; "Filter driver install"

[USBCCGP.Dev.NT.Services]
Addservice = USBCCGP, 0x00000002, USBCCGP.AddService
Addservice = FILTER, , SESFILTER.AddService  ; "Filter driver install"

[USBCCGP.AddService]
DisplayName    = %USBCCGP.SvcDesc%
ServiceType    = 1                  ; SERVICE_KERNEL_DRIVER
StartType      = 3                  ; SERVICE_DEMAND_START
ErrorControl   = 1                  ; SERVICE_ERROR_NORMAL
ServiceBinary  = %12%\USBCCGP.SYS
LoadOrderGroup = Base

[SESFILTER.AddService]                       ; "Filter driver install"
DisplayName    = %SESFILTER.SvcDesc%         ; "Filter driver install"
ServiceType    = 1                           ; "Filter driver install"
StartType      = 3                           ; "Filter driver install"
ErrorControl   = 1                           ; "Filter driver install"
ServiceBinary  = %12%\FILTER.SYS             ; "Filter driver install"
LoadOrderGroup = PnP Filter                  ; "Filter driver install"

[USBCCGP.Dev.NT.HW]                           ; "Filter driver install"
Addreg=SESFILTER_Filter_Reg                  ; "Filter driver install"

[SESFILTER_Filter_Reg]                       ; "Filter driver install"
HKR,,"UpperFilters",0x00010000,"FILTER"      ; "Filter driver install"

[Strings]
MfgName="Sample Driver"
USB\VID_07CC&PID_0003.DeviceDesc="Sample USB device"
USBCCGP.SvcDesc="USBCCGP.SYS Sample USB device driver"
SESFILTER.SvcDesc="FILTER.SYS Upper filter driver" ; "Filter driver install"