Where does the information on the Windows Security dialog during driver installation come from?

Question

We are currently working on a Windows device driver based on Jungo's WinDriver (not really the important part) framework. We have a VeriSign certificate and no issues with the signing process or the driver functionality.

However, during installation testing (on Windows 7) we are seeing some odd behavior regarding the Windows Security dialog that asks for install confirmation during the driver install.

In that dialog 3 fields seem to be displayed (ASCII'fied quote):

+----------------------------------------------------------------------+
| Windows Security                                                     |
+----------------------------------------------------------------------|
| Would you like to install this device software?                      |
|                                                                      |
| Name: <SOMETHING A> <SOMETHING B>                                    |
| Publisher: <COMPANY>                                                 |
|                                                                      |
+----------------------------------------------------------------------+
| <> Always trust software from "<COMPANY>"  [INSTALL] [DON'T INSTALL] |
+----------------------------------------------------------------------|
| Security info / warning etc.                                         |
+----------------------------------------------------------------------+

Now for some reason <SOMETHING A> and <SOMETHING B> are the same text. Which makes the dialog look kind of weird. This information comes from the INF file (at least that's what I believe right now) but so far I couldn't find detailed information on where it takes it from.

Right now it looks like it repeats the content of the "Provider" information in the INF file twice for some unknown (at least to me) reason.

Has anyone with more experience in this area (INF files, driver installs etc.) an idea what could cause this behavior?

Or maybe a link to some more information on what information from the INF file gets used in these dialog's?

Thanks for taking the time to read this and any advise regarding the issue.
-T

[Small update] Only the first part (<SOMETHING A>) seems to come out of the INF. Which makes the origin or the 2nd part even more puzzling ...

[Update 2] Copy of the INF per request (<...> are content edits)

[Version]
Signature=$CHICAGO$

Provider=%PROVIDERNAME%

CatalogFile.NTamd64=<SOME CAT FILE NAME>.cat

DriverVer=<DATE>,<VERSION>

Class=<OUR COMPANY>
ClassGuid={<OUR CLASS ID>}

;---------------------------------------------------------------;
; Driver Information
;---------------------------------------------------------------;
[Manufacturer]
%PROVIDERNAME%=DeviceList,NTamd64

; x86 platform, Win9x, Windows 2000 and later
[DeviceList]
%DESCRIPTION%=DriverInstall,*<OUR DRIVER HANDLE>

; x64 platform, Windows XP x64 edition and later
[DeviceList.NTamd64]
%DESCRIPTION%=DriverInstall,*<OUR DRIVER HANDLE>

;---------------------------------------------------------------;

;---------------------------------------------------------------;
; Source/Destination Information
;---------------------------------------------------------------;
[DestinationDirs]
DefaultDestDir=10,System32\Drivers

[SourceDisksFiles]
<OUR DRIVER NAME>.sys=1

[SourceDisksNames]
;1=%INSTDISK%,,,.
;Delete the above line and uncomment the next line for WHQL
1 = %INSTDISK%,<SOME CAT FILE NAME>.cat,,

;---------------------------------------------------------------;

;---------------------------------------------------------------;
; Installation Section
;---------------------------------------------------------------;

; Installation script for Windows 2000 and later
[DriverInstall.NT]
CopyFiles=DriverCopyFiles

[DriverCopyFiles]
<OUR DRIVER NAME>.sys,,,0x22    ; COPYFLG_NOSKIP | COPYFLG_NO_VERSION_DIALOG

[DriverInstall.NT.hw]
AddReg=DriverHwAddReg

[DriverHwAddReg]
HKR,,SampleInfo,,""

; Register a new class in Windows 2000 and later
[ClassInstall32]  ; Register a new class in Windows 2000 and later
AddReg=UpDateRegistry

[UpDateRegistry]
HKR,,,,<OUR COMPANY>
HKR,,Icon,,-5

; Add device driver service
[DriverInstall.NT.Services]
AddService=<OUR SERVICE NAME>, 0x00000002, DriverService

[DriverService]
ServiceType    = 1                  ; SERVICE_KERNEL_DRIVER
StartType      = 3                  ; SERVICE_DEMAND_START
ErrorControl   = 1                  ; SERVICE_ERROR_NORMAL
ServiceBinary = %10%\system32\drivers\<OUR DRIVER NAME>.sys

;------------------------------------------------------------------------------
;  String Definitions
;------------------------------------------------------------------------------

[Strings]
PROVIDERNAME=<THE NAME THAT SHOWS UP TWICE (BUT NOT REALLY)>
DESCRIPTION=<SOME DESCRIPTION>
INSTDISK="Driver Installation Disk"

The <THE NAME THAT SHOWS UP TWICE (BUT NOT REALLY)> is what shows up in <SOMETHING A>.

However, as pointed out with the small update 1, changing this value only leads to a change in said <SOMETHING A> but not the other part.

After changing some stuff around for testing the value that is displayed in <SOMETHING B> seems to appear "out of thin air" since I can't find it in the INF or RC file of the driver at all.

Answer 1

The name in the prompt comes from the INF file's DriverPackageDisplayName directive and the publisher comes from the verified signature on the CAT file.

Source: http://www.davidegrayson.com/signing/

Answer 2

Together with some other source (thanks to all the folks over at ntdev on osronline.com [esp. Maxim]) and some digging in the registry we believe we were finally able to resolve the origin of the dialog content. Below are the things that we found:

Using the dialog example again:

+----------------------------------------------------------------------+
| Windows Security                                                     |
+----------------------------------------------------------------------|
| Would you like to install this device software?                      |
|                                                                      |
| Name: <SOMETHING A> <SOMETHING B>                                    |
| Publisher: <COMPANY>                                                 |
|                                                                      |
+----------------------------------------------------------------------+
| <> Always trust software from "<COMPANY>"  [INSTALL] [DON'T INSTALL] |
+----------------------------------------------------------------------|
| Security info / warning etc.                                         |
+----------------------------------------------------------------------+

The fields seem to be resolved as follows:

<SOMETHING A> Seems to equal the value under "Provider" in you INF file

<SOMETHING B> Seems to have multiple cases:

• In cases where the device class already exists this value equals the value of "ClassDesc" in the appropriate registry key. (Found under: HKLM\SYSTEM\ControlSet001\Control\Class\<The GUID of your device class>)
• However, for system internal device classes the value appears not to be displayed although "ClassDesc" is not empty. It could also be that the value is not resolved correctly or just ignored "by choice" in these cases.
• Nothing will be displayed if this particular installation is the first time this device class is introduced to the system.

<COMPANY> Seems to simple equal the CN value from the certificate used to sign the driver.

Maybe there is still a little more to it so please feel free to add additional information. But hopefully this will at least help point somebody looking for the same information into the right direction.