升级win10带来硬件无法使用，需要解决数字签名的问题。

最新推荐文章于 2021-09-02 15:30:18 发布

dongxinddd123

最新推荐文章于 2021-09-02 15:30:18 发布

阅读量2.8k

点赞数

本文链接：https://blog.csdn.net/dongxinddd123/article/details/86214786

版权

1. 从这里https://docs.microsoft.com/zh-cn/windows-hardware/drivers/download-the-wdk。下载。

安装了最新的wdk,
https://docs.microsoft.com/zh-cn/windows-hardware/drivers/, 这里是使用说明。

C:\Windows\System32>makecert /?
Usage: MakeCert [ basic|extended options] [outputCertificateFile]
Basic Options
 -sk  <keyName>      Subject's key container name; To be created if not present
 -pe                 Mark generated private key as exportable
 -ss  <store>        Subject's certificate store name that stores the output
                     certificate
 -sr  <location>     Subject's certificate store location.
                        <CurrentUser|LocalMachine>.  Default to 'CurrentUser'
 -#   <number>       Serial Number from 1 to 2^31-1.  Default to be unique
 -$   <authority>    The signing authority of the certificate
                        <individual|commercial>
 -n   <X509name>     Certificate subject X500 name (eg: CN=Fred Dews)
 -?                  Return a list of basic options
 -!                  Return a list of extended options

Version 3.3.0.0
Runs driver signability tests and creates the catalog(s).

INF2CAT /driver:path /os:operatingSystem1[,os2]...
        [/nocat] [/verbose]
        [/drm[:file1[,file2]...]]
        [/pe[:file1[,file2]...]]
        [/pageHashes[:file1][,file2]...]]

  /driver (/drv)    Indicates the path to the driver package follows.

  path              Specifies the path to the driver package.

  /os               Indicates the operating system(s) targeted by the driver
                    package follows. The targeted operating system(s) is a
                    comma separated list of the following values:

  operatingSystem1  2000

                    XP_X86           Server2003_X86
                    XP_X64           Server2003_X64
                                     Server2003_IA64

                    Vista_X86        Server2008_X86
                    Vista_X64        Server2008_X64
                                     Server2008_IA64

                    7_X86
                    7_X64            Server2008R2_X64
                                     Server2008R2_IA64

                    8_X86
                    8_X64            Server8_X64
                    8_ARM

                    6_3_X86
                    6_3_X64          Server6_3_X64
                    6_3_ARM

                    10_X86
                    10_X64           Server10_X64
                                     Server10_ARM64

                    10_AU_X86
                    10_AU_X64        Server2016_X64

                    10_RS2_X86
                    10_RS2_X64       ServerRS2_X64

                    10_RS3_X86
                    10_RS3_X64       ServerRS3_X64
                    10_RS3_ARM64
                    10_RS4_X86
                    10_RS4_X64       ServerRS4_X64
                    10_RS4_ARM64     ServerRS4_ARM64

  /uselocaltime     Use local timezone while running driver
                    timestamp verification tests. By default UTC is used.

  /nocat            Prevents the creation of the catalog(s).

  /verbose (/v)     Displays detailed console output.

  /drm              (Deprecated command line arg. Add drm signature attribute in .inf file to add drm signature attribute)

  /pe               (Deprecated command line arg. Add petrust signature attribute in .inf file to add petrust signature attribute)

  /pageHashes       Include page hashes with files.  Optionally
                    followed by a list of files.

运行cmd，cd到driver目录

1.生成cat文件
Inf2Cat.exe /driver:. /os:10_X64
2.生成cer文件
makecert -r -pe -ss Ctcloud -n CN=Ctcloud.com(Test) djx64.cer

3.3.对cat文件进行签名

signtool sign /v /ac "djx64.cer" /s MY /n "djx64" "djx64.cat" 出现问题
SignTool Error: No certificates were found that met all the given criteria.

改用

Signtool sign /a /v /s Ctcloud /n Ctcloud.com(Test) /t http://timestamp.verisign.com/scripts/timestamp.dll djx64.cat

Signtool sign /a /v /s Ctcloud /n Ctcloud.com(Test) /t http://timestamp.verisign.com/scripts/timestamp.dll dj.sys
Signtool sign /a /v /s Ctcloud /n Ctcloud.com(Test) /t http://timestamp.verisign.com/scripts/timestamp.dll ezmon.sys
Signtool sign /a /v /s Ctcloud /n Ctcloud.com(Test) /t http://timestamp.verisign.com/scripts/timestamp.dll ezusb.sys

安装时候说无法放到存储区。

第一种方案：临时禁用驱动签名验证

按着shift，重启系统 -》选择高级选项 -》选择启动设置，进入启动选项界面，选择“进入驱动程序强制签名”（一般为F7按键）。

第二种方案：永久禁用驱动签名验证

（1）确保bios里的security boot选项为disable状态

（2）执行如下命令，禁用驱动签名检测

bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit -set TESTSIGNING ON

（3）如果需要回复驱动签名检测，执行如下脚本，然后在bios里面启用security boot

bcdedit -set loadoptions ENABLE_INTEGRITY_CHECKS
bcdedit -set TESTSIGNING OFF

参考了如下链接：