Windows Driver Testing

Windows Driver Testing Basics: Tools, Features, and Examples
This article is aimed at helping you test drivers for Windows. Since there are many
different types of drivers, we cover the specifics of each type and explain how the
Windows device driver testing process differs. We also cover supplementary tools and
– another quite important topic – driver signatures.
Written by:
Denys Rudov
Senior Tester
Driver Testing Team
and
Dmitriy Yurko
Test Designer
Driver Testing Team
Contents:
Definition and Types of Windows Drivers
The Main Aspects of Windows Driver Testing
How To Test Windows Drivers
Utilities for Driver Testing and Analysis
Error Localization
Driver Testing Report Sample

Definition and Types of Windows Drivers
A driver is a software component that provides an interface for a physical or virtual
device. A driver interprets high-level requests coming from user software and the
operating system into low-level commands recognized by a device.
Driver Location in Windows
In Windows, drivers are stored as binary files with the .sys extension along with
optional supplementary files with .inf and .cat extensions.
.inf Files
The .inf file is a driver installation file that describes the type of device that a driver is
designed for, the location of driver files, and any dependencies. During driver
installation, data is entered in the system registry from the .inf file. This registry serves
as a database for a driver’s configuration.
.cat Files
A .cat catalogue file contains a list of cryptographic hash sums of all driver files. In
Windows, installed drivers are usually stored in the %SystemRoot%\System32\drivers
system catalogue, but they can also be stored in any other place. After installation, a
driver is loaded in the system and is ready to work. Some driver types require a reboot
after installation.
Driver Types
Drivers can be divided into user-mode and kernel-mode types depending on their mode
of execution.
User-Mode Drivers
User-mode drivers provide an interface between user applications and other operating
system components such as kernel-mode drivers. A printer driver is an example of a
user-mode driver.
Kernel-Mode Drivers
Kernel-mode drivers are executed in the privileged kernel mode. Kernel-mode drivers
are usually in the form of a chain formed during driver execution. The location of each
driver in this chain is defined by its task.
Queries from user applications to a device pass through several drivers. Each of these
drivers processes and filters the query, which is called an IRP packet (I/O request
packet) according to Windows driver terminology. If a driver is loaded in the wrong
place in the chain, then the query will be processed incorrectly and, as a result, the
system may crash.

Figure 1 below represents a simplified model of such a query for disk-based input-
output (I/O). A user app creates a query to read a file on the disk. This query passes
through a chain of drivers, each of which processes incoming and outgoing packets.
Simplified model of a driver query from a user application
In this article, we’ll focus on kernel-mode drivers.
Kernel-mode drivers can be divided into the following types:
Plug and play device drivers. These drivers ensure access to physical plug and play
(PnP) devices and manage device power.
Non plug- and play drivers. These drivers enhance user application functionality and
provide access to kernel-mode features that are unavailable via standard API calls.
These drivers don’t work with physical devices.
File system drivers. These drivers provide access to the file system. They transform
high-level queries for reading/recording files to low-level commands for a disk driver
(reading/recording a sector on a physical disk).
There is a driver development model called the Windows Driver Model (WDM) as well
as a Windows Driver Framework (WDF), which consists of the Kernel-Mode Driver
Framework (KMDF) and User-Mode Driver Framework (UMDF). Both the WDM and
WDF simplify the process of making driver code compatible across Windows versions.
Within the WDM are the following driver types:

Bus drivers. These drivers support a specific PCI, SCSI, USB, or other port, controlling
the connection of new devices to the bus.
Functional drivers. These drivers ensure the functionality of a specific device. They
usually support reading/recording operations and device power management.
Filter drivers. These drivers modify queries to a device. They can be situated either
above or below a functional driver in the chain of drivers.
The Relationship between a Driver and a Device
Each kernel-mode driver works with a specific device, represented in Windows as a
device object. This means that the final destination for an I/O query coming through a
driver is always a physical or virtual device. This applies to both drivers of physical PnP
devices as well as non-PnP software drivers. While testing drivers, it’s important to
understand that more than one driver exists between a user application and a device.
In the chain, each driver can influence the final result of the query to the device.
The Main Aspects of Windows Driver Testing
There are certain tests that are required for Windows driver testing in Linux, and
Windows regardless of driver type. So before covering the nuances of testing different
types of drivers, we’ll consider their common aspects.
Operating Systems
First, you always have to keep in mind that a particular driver can behave differently on
different operating systems. Furthermore, you need to take different kernel versions
into account because they can differ even within the same operating system. For
instance, Windows 7 and Windows 7 sp1 have different kernels. Therefore, you must
test as many systems as possible. It’s worth mentioning that Microsoft supports
Windows versions starting from Windows 7/2008. You also have to take into account
that the most popular Windows versions now are Windows 7 and 10.
Updates
It’s necessary to check critical situations for a driver such as shutdown, reboot, and
reset. You should also keep a system’s security systems in mind: firewalls, data
execution prevention (DEP), user account control (UAC), and antivirus software.
Operating system updates can also influence driver functionality. Therefore, it’s crucial
to perform testing with the latest updates. In addition, you also need to test driver
updates.
Hardware Dependency
Besides software dependency, there’s also hardware dependency. That’s why you
have to check how a driver works with various processor and kernel configurations with
an enabled and disabled page file. While testing a driver, you have to enable a driver

verifier, which will create an additional load for the driver. During a testing process,
check the correctness of driver installation and uninstallation, system reset, and
hibernation.
How To Test Windows Drivers
Testing a driver using a real machine isn’t always secure since incorrect operation can
lead to serious consequences. That’s why you should test a driver in a virtual machine
until it’s stable.
File System Filter Drivers
As the name suggests, system filter drivers work with file systems. Therefore, while
testing such drivers, you should use file systems such as NTFS, FAT32, exFAT, and
ReFS.
To test a Windows driver correctly, you should take into account that various file
managers can be used besides Explorer, such as FAR or Windows Total Commander.
And don’t forget about complex file system changes in addition to simple operations
such as copying, deleting, and renaming.
Complex file system changes include:
 Mounting/unmounting new disks:
o ISO images;
o Network disks
o Virtual hard disks
o USB flash drives
 Making sector configuration changes (changing drive letter or name)
 Actions performed on a disk:
o Formatting sectors
o Shrinking sectors
o Defragmenting sectors
o Checking for errors
o Compressing sectors
o Deleting sectors
o Making a disk dynamic
o Converting a disk in GPT/MBR
o Creating a new sector.
You also have to check:
 Various hardware configurations (SSDs and HDDs with different capacities)
 Driver behavior when stopping and starting services or installing/uninstalling an
app
 How a driver works with an encrypted disk using Windows tools
 Driver compatibility with antivirus software, as such software is also a filter driver.