• From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Yeah, I for one do not need the .org files indexed.

For file version comparison, definitely go for the .sys file.  A basic driver consists of a .sys with matching .inf.  A .cat would only be present for driver signing (not guaranteed) and .dll files are only for drivers adding significant functionality not already present in the OS libraries.

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!
  • From: Springfield, MA, USA
  • Registered: 2007-09-21
  • Posts: 396

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Thanks for the information mr_smartepants that definitely helps... I should have a new version soon! As a general rule of thumb is it only one .sys file per inf?

Search your INF's for Hardware ID's with FindHWIDS

stamandster's Website

  • From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Well, mostly.  There are a few oddball driver OEMs out there that really know how to screw-up a decent driver.
Check out the DriverPack Sound A\D\S\CR\wdma_emu.inf to see what I'm talking about.  It only supports one X-Fi card and yet look at all the .sys files it needs!
Geez!  That's ridiculous!

[SourceDisksFiles]
ctzapxx.ini=55
instwdm.ini=55
kill.ini=55,Common
CT1MGM.ROM=55,Common
CT2MGM.SF2=55,Common
default4.sfm=55,Common
default8.sfm=55,Common
default.sfm=55,Common
ctac32k.sys=55,Win2K_XP\i386
ctaud2k.sys=55,Win2K_XP\i386
ctoss2k.sys=55,Win2K_XP\i386
ctprxy2k.sys=55,Win2K_XP\i386
ctsfm2k.sys=55,Win2K_XP\i386
emupia2k.sys=55,Win2K_XP\i386
ha20x2k.sys=55,Win2K_XP\i386
ha20x22k.sys=55,Win2K_XP\i386
pfmodnt.sys=55,Win2K_XP\i386
CTEXFIFX.SYS=55,Win2K_XP\i386
CT20XUT.SYS=55,Win2K_XP\i386
CTHWIUT.SYS=55,Win2K_XP\i386
regplib.exe=55,Common\i386
CTAPO32.dll=55,Common\i386
ctppld.dll=55,Common\i386
APOIM32.exe=55,Common\i386
AddCat.exe=55,Common\i386
CTAPO32.UDA=55
CTMLFX32.UDA=55
AppSetup.exe=55,Common\i386

a3d.dll=55,Common\i386
ac3api.dll=55,Common\i386
eaxac3.dll=55,Common\i386
ctosuser.dll=55,Common\i386
ctemupia.dll=55,Common\i386
piaproxy.dll=55,Common\i386
ctdproxy.dll=55,Common\i386
devreg.dll=55,Common\i386
sfman32.dll=55,Common\i386
sfms32.dll=55,Common\i386
ctasio.dll=55,Common\i386
ct_oal.dll=55,Common\i386
oalinst.exe=55,Common\i386
ctpxst32.exe=55,Common\i386
cttele32.dll=55,Common\i386

CTxfiBtn.dll=55,Common\i386
CTxfiSpk.dll=55,Common\i386
Ct20xspi.dll=55,Common\i386
CTxfispi.exe=55,Common\i386
Ctxfihlp.exe=55,Common\i386

;; matrix Fx Sound
CTMLFX32.dll=55,Common\i386
;;OPT352.dll=55,Common\i386
;;OPTPropPage.dll=55,Common\i386

CTxfiReg.exe=55,Common\i386
killapps.exe=55,Common\i386
enlocstr.exe=55,Common\i386

ctcoinst.dll=55,Win2K_XP\i386
ctdvinst.dll=55,Win2K_XP\i386
SBXFi.ico=55,Win2K_XP
XFi.bmp=55,Win2K_XP
cts20x.dat=55,Win2K_XP\Data
ctd20x.dat=55,Win2K_XP\Data

;lang
ctdlang.dat=55,Win2K_XP
ctdnlstr.dat=55,Win2K_XP
CtxfiRes.dll=55,lang\i386

;XP Databases
CTP0460W.DAT=55,Win2K_XP\Data
CTP0466W.DAT=55,Win2K_XP\Data
CTP0463W.DAT=55,Win2K_XP\Data
CTP0550W.DAT=55,Win2K_XP\Data
CTP0678W.DAT=55,Win2K_XP\Data
CTP0679W.DAT=55,Win2K_XP\Data
CTP0464W.DAT=55,Win2K_XP\Data
CTP0468W.DAT=55,Win2K_XP\Data
CTP0465W.DAT=55,Win2K_XP\Data
CTP0469W.DAT=55,Win2K_XP\Data
CTP0730W.DAT=55,Win2K_XP\Data
CTP0760W.DAT=55,Win2K_XP\Data
CTP046AW.DAT=55,Win2K_XP\Data
CTP046BW.DAT=55,Win2K_XP\Data
CTP046CW.DAT=55,Win2K_XP\Data
CTP0462W.DAT=55,Win2K_XP\Data
CTP055AW.DAT=55,Win2K_XP\Data
CTP073AW.DAT=55,Win2K_XP\Data
CTP0773W.DAT=55,Win2K_XP\Data
CTP0779W.DAT=55,Win2K_XP\Data
CTP0776W.DAT=55,Win2K_XP\Data
CTP0772W.DAT=55,Win2K_XP\Data
CTP0775W.DAT=55,Win2K_XP\Data
CTP0880W.DAT=55,Win2K_XP\Data
CTP0882W.DAT=55,Win2K_XP\Data
CTP0886W.DAT=55,Win2K_XP\Data
CTP0883W.DAT=55,Win2K_XP\Data
CTP0889W.DAT=55,Win2K_XP\Data
CTP0888W.DAT=55,Win2K_XP\Data
CTP0881W.DAT=55,Win2K_XP\Data

;Vista Databases
CTP0773V.DAT=55,Win2K_XP\Data
CTP0779V.DAT=55,Win2K_XP\Data
CTP0776V.DAT=55,Win2K_XP\Data
CTP0772V.DAT=55,Win2K_XP\Data
CTP0775V.DAT=55,Win2K_XP\Data
CTP0880V.DAT=55,Win2K_XP\Data
CTP0882V.DAT=55,Win2K_XP\Data
CTP0886V.DAT=55,Win2K_XP\Data
CTP0883V.DAT=55,Win2K_XP\Data
CTP0889V.DAT=55,Win2K_XP\Data
CTP0888V.DAT=55,Win2K_XP\Data
CTP0881V.DAT=55,Win2K_XP\Data

;Mode configs
CTXFIGM.RFX=55,Win2K_XP\Data
CTXFIEM.RFX=55,Win2K_XP\Data
CTXFICM.RFX=55,Win2K_XP\Data
CTXFICBM.RFX=55,Win2K_XP\Data

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!
  • From: Springfield, MA, USA
  • Registered: 2007-09-21
  • Posts: 396

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Wow that's crazy! Would it be helpful to you to have a listing per INF of all these driver files and if they actually exist in each INF's root folder?

Search your INF's for Hardware ID's with FindHWIDS

stamandster's Website

  • From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Ooh, that would be a nice troubleshooting tool.  To chase down the sourcediskfiles?
Sure!
But not all the files are at the INF root folder.  In the example above, they're scattered throughout the folder structure.

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!
  • From: Springfield, MA, USA
  • Registered: 2007-09-21
  • Posts: 396

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Ahhh... can you give me some examples?

Search your INF's for Hardware ID's with FindHWIDS

stamandster's Website

  • From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

You mean apart from the above example?  I thought that was a pretty good one! wink
h*ll, any of the (un)Creative folders will suffice as an example (of poor driver engineering).

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!
  • From: Springfield, MA, USA
  • Registered: 2007-09-21
  • Posts: 396

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Oh I was confused... so when it says "55,Win2K_XP\Data" that means it's the subfolders Win2K_XP\Data... i get it.. thanks!

Search your INF's for Hardware ID's with FindHWIDS

stamandster's Website

  • From: Springfield, MA, USA
  • Registered: 2007-09-21
  • Posts: 396

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

I'm finding that the the files that need to be copied to the system not being in the root folder of the driver is really, REALLY, few and far between. I'm not sure what to do about it. I'm not sure exactly what the value of each key means for instance some are 1,1,,,,,10000 or something similar.

Search your INF's for Hardware ID's with FindHWIDS

stamandster's Website

  • OverFlow
  • DriverPacks Administrator & BASE Developer
  • Offline
  • From: Cincinnati
  • Registered: 2006-12-02
  • Posts: 6,730

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

cdob provided me that info when i was doing the BartPE plugin... and i have it printed out but i can't find it online ATM... perhaps he will stop by and re-provide it big_smile.

DP BartPE Tutorial   DP_BASE Tutorial   HWID's Tool     Read BEFORE you post    UserBars!
http://driverpacks.net/userbar/admin-1.png
The DriverPacks, the DP_Base program, and Support Forum are FREE!.

OverFlow's Website

  • From: Springfield, MA, USA
  • Registered: 2007-09-21
  • Posts: 396

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Found it! Well something similar I would imagine... time for a read...

http://www.osronline.com/ddkx/install/i … t_4836.htm

I appreciate the help Jeff.

Last edited by stamandster (2011-03-18 00:34:39)

Search your INF's for Hardware ID's with FindHWIDS

stamandster's Website

  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Avira is freaking out on me (spazz).  It claims to have found the 'SPR/AutoIt.Gen' special detection.  details here http://www.avira.com/en/support-threats … 5/tlang/en sad
FindHWIDS v3.2p has been detected as 'Programs that violate the private domain' "This is a program that may be capable of compromising the security of your system, triggering malware activities or invading your privacy".

I've resolved this by unpacking the file.  No detection now.

Perhaps a change could be made to the program to prevent this signature-based detection?  I wonder if this is the only AntiVirus that falsely detects this as a virus.

Last edited by TechDud (2011-08-10 19:32:46)

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • From: Springfield, MA, USA
  • Registered: 2007-09-21
  • Posts: 396

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

TechDud wrote:

Avira is freaking out on me (spazz).  It claims to have found the 'SPR/AutoIt.Gen' special detection.  details here http://www.avira.com/en/support-threats … 5/tlang/en sad
FindHWIDS v3.2p has been detected as 'Programs that violate the private domain' "This is a program that may be capable of compromising the security of your system, triggering malware activities or invading your privacy".

I've resolved this by unpacking the file.  No detection now.

Perhaps a change could be made to the program to prevent this signature-based detection?  I wonder if this is the only AntiVirus that falsely detects this as a virus.

No clue other than alot of autoit scripts get's falsely detected. I think it's because its a UPX compiled file and many viruses use this to fuzz themselves. The only thing integrated is fshash.dll and some images. Not sure how you "unpacked" the executable though.

Last edited by stamandster (2011-08-11 12:16:17)

Search your INF's for Hardware ID's with FindHWIDS

stamandster's Website

  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

UniExtract Kicks Ass!  http://legroom.net/software/uniextract  One handy feature is the 'Append missing file extensions' checkbox.  I love freeware! cool

I made sure it wasn't a heuristic-based detection, & I had the Threat Category 'Unusual run-time compression' deselected.   I've been hearing that most AntiVirus programs are notorious for not removing known false-detections.  I knew Mr_Smartepants wasn't trying a 'social-engineering' trick on me; he knows i do well enough at killing my own hardware! big_smile  http://forum.driverpacks.net/viewtopic.php?id=5291  As it turned out, i did have a blown capacitorin my power supply, just to add to the digital mayhem! (so much for the theory that computers cannot start with blown capacitors)

The latest Excel Viewer doesn't seem to like CSV files anymore; LibreOffice seems to work though.  If only FindHWIDS could build a CSV list of files/path referenced in the 'CatalogFile=' & '[  .CopyFiles]' sections.  The CreativeLabs Live to XiFi drivers should be an interesting test for such a feature; they are Mr_Smartepants' favorite! lol

Last edited by TechDud (2011-08-11 23:04:43)

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

TechDud wrote:

If only FindHWIDS could build a CSV list of files/path referenced in the 'CatalogFile=' & '[  .CopyFiles]' sections.

Yes, basically it would be a "missing-file...finder"
Not all files required by the driver are referenced in the [sourcediskfiles] section but can also be referenced in the [*copyfiles*] sections.

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!
  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

I'm up to about 12000 files for the monitor pack, so far.  That will take a while to reference, manually! yikes
Current Changelog:  http://forum.driverpacks.net/viewtopic. … 838#p44838

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Would it be possible to add an option to be able to output sha1 CRC values, instead of MD5?  sha1 is the format used by MS Security Catalog files (.cat).
Thank you for any consideration.

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

The BitDefender 'Rescue CD' claims that both 'FindHWIDS.v3.2p.exe' & the unpacked 'FindHWIDS.v3.2p_unpacked.exe' have the virus "Gen.Trojan.Heur.AutoIT.1".
I don't know if the main program gives the same false-positive.

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • OverFlow
  • DriverPacks Administrator & BASE Developer
  • Offline
  • From: Cincinnati
  • Registered: 2006-12-02
  • Posts: 6,730

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Autoit is used to create findhwids... many lame virus scanners will flag any program written in AutoIt as a virus (DriverPacks BASE included)

this is because some malware programs are written in AutoIt... however just because a program is written in AutoIt does not mean that it is a virus... this is a problem with the virus scanner not the app. Please report the false positive to the offending scanners support contact.

TY

DP BartPE Tutorial   DP_BASE Tutorial   HWID's Tool     Read BEFORE you post    UserBars!
http://driverpacks.net/userbar/admin-1.png
The DriverPacks, the DP_Base program, and Support Forum are FREE!.

OverFlow's Website

  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

On my next set of scans, i will see if i can somehow turn of heuristics; to see if it still nags me.  This should be known as a 'PUP' (key word being Potentially).  BitDefender offers 'no support whatsoever' with their liveCD, i won't try to contact them.  I will venture to contact AntiVirus companies whose products i actually use regularly.

I wonder if it would be possible to add the option for FindHWID's to output 'relative paths' instead? hmm

Last edited by TechDud (2011-08-31 14:56:14)

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • OverFlow
  • DriverPacks Administrator & BASE Developer
  • Offline
  • From: Cincinnati
  • Registered: 2006-12-02
  • Posts: 6,730

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

relative paths... hmmm

your mothers mother is your grandmother... your sisters daughter is your niece. your sisters mother is your mother. you cousins dad is your uncle.

You mean like that?

DP BartPE Tutorial   DP_BASE Tutorial   HWID's Tool     Read BEFORE you post    UserBars!
http://driverpacks.net/userbar/admin-1.png
The DriverPacks, the DP_Base program, and Support Forum are FREE!.

OverFlow's Website

  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Not if you account for the possibility of time-paradox! big_smile

I find the output to be too long for easy comparison with a large number of files.

PS:  Doing the 'nasty' in the past-y is highly discouraged; whom would want to be their own grandfather, unless your a fictitious named 'Fry'!

Last edited by TechDud (2011-08-31 15:01:46)

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

TechDud wrote:

I find the output to be too long for easy comparison with a large number of files.

I agree, but it's easily fixed in about 2 seconds with ctrl-H to replace A:\ridiculously\long\file\path\ with %blank%

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!
  • TechDud
  • Researcher & DriverPacks Moderator
  • Offline
  • From: Fraser Valley, Canada
  • Registered: 2010-11-23
  • Posts: 2,270

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

Very true, thank you for your 360° thinking!

Forum Rules & Guidelines   HWID's tool   Unknown Devices (Win7-max) LatencyMon - NT6.x
MemTest86+    Video Memory Stress Test    D-P-C Driver Latency Tester (Win7-max)
http://d1syubgj0w3cyv.cloudfront.net/cdn/farfuture/5NQ1BpqvDa_0vDwtHeoZCcSJjOVNuvMXSp4i7SE7DQA/perpetual:forever/userbar/moderator-1.png
  • From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: FindHWIDS v3.2s - The INF Searching, Hardware ID Exporter

@KickArse, I have a request.
Would it be possible to scan an .ini instead of .inf files?  I want to scan the dpms .ini and search for duplicated HWIDs.  Some of the LSI sections have nearly 200 HWIDs on a single line.  I can't do that manually. sad

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!