[9fans] bind on windows?

[9fans] bind on windows?

[Nick LaForge]

On Windows, I often want to plop a single file into some admin-owned
directory.  E.g., I have +rx perms but not write, and some
admin-installed program insists on writing to or reading/executing a
plugin of mine in its own u-w directory.  Has anybody used something
like bind on Windows?  I found this, but it looks like overkill:
http://dokan.googlecode.com/svn/trunk/dokan/readme.txt

Re: [9fans] bind on windows?

[Nick LaForge]

(should have said o-w and not u-w)

On 4/1/12, Nick LaForge <nicklaforge@gmail.com> wrote:
> On Windows, I often want to plop a single file into some admin-owned
> directory.  E.g., I have +rx perms but not write, and some
> admin-installed program insists on writing to or reading/executing a
> plugin of mine in its own u-w directory.  Has anybody used something
> like bind on Windows?  I found this, but it looks like overkill:
> http://dokan.googlecode.com/svn/trunk/dokan/readme.txt
>

Re: [9fans] bind on windows?

[Aram Hăvărneanu]

When I was writing Windows file systems for living, I played with the
Dokan library. Played is a very good word, it's a toy, at best. And
maybe even that's an overstatement.

Implementing bind in a file system filter is easy, as far as writing
Windows filesystems goes, but unfortunately to be able to hand it to
people you need to pay around $400 to some certificate authority to
sign your kernel mode driver, else Windows won't load it.

If you're the only user you can add yourself as a certificate
authority, and you can use your own work for free.

Re: [9fans] bind on windows?

[Nick LaForge]

Thanks; it's for my own convenience and not for others, so
certificates aren't an issue.

On 4/1/12, Aram Hăvărneanu <aram.h@mgk.ro> wrote:
> When I was writing Windows file systems for living, I played with the
> Dokan library. Played is a very good word, it's a toy, at best. And
> maybe even that's an overstatement.
>
> Implementing bind in a file system filter is easy, as far as writing
> Windows filesystems goes, but unfortunately to be able to hand it to
> people you need to pay around $400 to some certificate authority to
> sign your kernel mode driver, else Windows won't load it.
>
> If you're the only user you can add yourself as a certificate
> authority, and you can use your own work for free.
>
>

Re: [9fans] bind on windows?

[erik quanstrom]

> > Implementing bind in a file system filter is easy, as far as writing
> > Windows filesystems goes, but unfortunately to be able to hand it to
> > people you need to pay around $400 to some certificate authority to
> > sign your kernel mode driver, else Windows won't load it.

iirc, you can load it, but it requires some hoops.  getting a hoop-free
version requires a whcl sig, and that costs $75 and a few days of tests.

- erik

Re: [9fans] bind on windows?

[Aram Hăvărneanu]

> iirc, you can load it, but it requires some hoops.  getting a hoop-free
> version requires a whcl sig, and that costs $75 and a few days of tests.

You can load it in either two ways, you can boot into test mode, which
disables signature checking and writes "Test mode" in the bottom right
corner of the screen, or you can properly sign the binary yourself and
add yourself as a root CA in the certificate store.

Loading a kernel mode binary doesn't require a WHQL cross-signature,
but WHQL will disable some yellow warnings otherwise shown to the
user. WHQL is very expensive, depends on the type of driver, for what
I was doing it was in the order of $2k/test. Every new version of the
binary required a new test. Other types of drivers are cheaper or more
expensive, we never bothered with WHQL, it was too expensive for us.
There was no WHQL option for file system and I believe that stands
true today as well.

Regular, non-WHQL signature you can use are much expensive than $75,
they are in the order of $500/year:
http://www.symantec.com/verisign/code-signing/microsoft-authenticode/buy

-- 
Aram Hăvărneanu

Re: [9fans] bind on windows?

[erik quanstrom]

> Loading a kernel mode binary doesn't require a WHQL cross-signature,
> but WHQL will disable some yellow warnings otherwise shown to the
> user. WHQL is very expensive, depends on the type of driver, for what
> I was doing it was in the order of $2k/test. Every new version of the
> binary required a new test. Other types of drivers are cheaper or more
> expensive, we never bothered with WHQL, it was too expensive for us.
> There was no WHQL option for file system and I believe that stands
> true today as well.

i have no explaination for the differences you see, but this is even more
pointless than a bike shed argument.  since in the end, the ms machinery
painted the shed whatever color it wanted and now even it itself is locked in for
eternity.  :-)

- erik