InstallHinfSection卸载驱动未删注册表项与服务问题排查

我在Win10系统中使用InstallHinfSection API进行内核驱动的安装与卸载操作，安装过程无异常：驱动成功复制到DriverStore，必要的注册表项和服务也已创建。但卸载时不符合预期：驱动虽已从DriverStore移除，但注册表项和服务未被删除，执行sc query mydriver显示驱动处于STOPPED状态。

残留的注册表项如下：

• Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mydriver
• Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mydriver

安装命令：

RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\mydriver.inf

卸载命令：

RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 C:\mydriver.inf

使用的INF文件：

[Version]
Signature   = "$Windows NT$"
Class       = MYDRIVER
ClassGuid   = {00F8631E-F7E7-477e-B0AE-748C1915CEDE}
Provider    = %Manufacturer%
DriverVer   = 08/10/2023,15.8.00400.00004
CatalogFile = mydriver.cat
DriverPackageType = KernelService

[DestinationDirs]
DefaultDestDir          = 12
Section.DriverFiles       = 12                            ;%windir%\\system32\\drivers

;;
;; Default install sections
;;
;x64 install
[DefaultInstall.NTAMD64]
OptionDesc          = %ServiceDescription%
CopyFiles           = Section.DriverFiles

[DefaultInstall.NTAMD64.Services]
AddService          = %ServiceName%,,Section.Service,Section.Eventlog

;;
;; Default uninstall sections
;;

;x64 uninstall

[DefaultUninstall.NTAMD64]
DelFiles   = Section.DriverFiles
LegacyUninstall=1

[DefaultUninstall.NTAMD64.Services]
DelService = %ServiceName%,0x200      ;Ensure service is stopped before deleting

[SourceDisksFiles]
mydriver.sys = 1

[SourceDisksNames]
1 = %Disk1%

;
; Services Section
;
[Section.Service]
DisplayName      = %ServiceName%
Description      = %ServiceDescription%
ServiceBinary    = %12%\\%ServiceName%.sys      ;%windir%\\system32\\drivers\\
ServiceType      = 1                    ;SERVICE_FILE_SYSTEM_DRIVER
StartType        = 3                    ;SERVICE_DEMAND_START
ErrorControl     = 1                    ;SERVICE_ERROR_NORMAL
AddReg           = Section.AddRegistry;,Section.Eventlog.AddRegistry

;
; Registry Modifications
;
[Section.AddRegistry]
HKR,%RegInstancesSubkeyName%,%RegDefaultInstanceValueName%,0x00000000,%DefaultInstance.Name%
HKR,%RegInstancesSubkeyName%"\\"%DefaultInstance.Name%,%RegFlagsValueName%,0x00010001,%DefaultInstance.Flags%

[Section.Eventlog]
AddReg = Section.Eventlog.AddRegistry

[Section.Eventlog.AddRegistry]
;HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\\Sytem32\\IoLogMsg.dll;%%SystemRoot%%\\System32\\drivers\\mydriver.sys"
;HKR,,TypesSupported,0x00010001,7

;
; Copy Files
;
[Section.DriverFiles]
mydriver.sys

;;
;; String Section
;;
[Strings]
Manufacturer            = "Xyz"
ServiceName             = "mydriver"
ServiceDescription      = "Real Time Application Monitor"
RegInstancesSubkeyName  = "Instances"
RegDefaultInstanceValueName  = "DefaultInstance"
RegFlagsValueName       = "Flags"
Disk1           = "MYDRIVER Source Media"

;Instances specific information.

DefaultInstance.Name            = "Default"
DefaultInstance.Flags           = 0x0          ; Suppress automatic attachments

核心问题点 #

1. LegacyUninstall=1的限制：该配置会触发SetupAPI的兼容模式卸载，跳过现代驱动包的完整清理逻辑，包括服务注册表项的删除。
2. DelService参数不完整：当前0x200仅确保停止服务，未添加删除注册表项的标记。
3. 自定义注册表项未清理：安装阶段通过Section.AddRegistry添加的Instances分支，卸载时无对应删除逻辑。

具体修复步骤 #

1. 修改INF卸载配置 #

移除LegacyUninstall=1

删除[DefaultUninstall.NTAMD64]中的LegacyUninstall=1，启用原生驱动卸载流程：

[DefaultUninstall.NTAMD64]
DelFiles   = Section.DriverFiles

更新DelService参数

将标记改为0x204（0x200+0x4），0x4表示删除服务时同步清理对应注册表项：

[DefaultUninstall.NTAMD64.Services]
DelService = %ServiceName%,0x204      ;停止服务并删除注册表项

添加自定义注册表删除逻辑

新增卸载用的注册表删除节，并关联到卸载主流程：

;; 新增卸载注册表删除节
[DefaultUninstall.NTAMD64.AddReg]
HKR,%RegInstancesSubkeyName%,%RegDefaultInstanceValueName%,0x00020002
HKR,%RegInstancesSubkeyName%"\\"%DefaultInstance.Name%,0x00020002

;; 关联到卸载主节
[DefaultUninstall.NTAMD64]
DelFiles   = Section.DriverFiles
AddReg = DefaultUninstall.NTAMD64.AddReg

• 0x00020002是注册表删除标记：0x20000指定操作目标为HKR，0x2表示删除指定值或子键。

2. 验证卸载命令 #

当前卸载命令的128参数正确（表示卸载模式），需确保以管理员权限执行命令。

3. 手动清理残留（临时方案） #

若修改INF后仍有残留，可执行以下命令手动清理：

sc stop mydriver
sc delete mydriver

再通过注册表编辑器删除残留的HKLM\SYSTEM\ControlSet001\Services\mydriver和HKLM\SYSTEM\CurrentControlSet\Services\mydriver项。

内容的提问来源于stack exchange，提问作者Ankur Garg