;;;
;;; MBAM Real-time Protection File System Filter Driver
;;;
;;;
;;; Copyright (c) 2017, Malwarebytes
;;;

[Version]
Signature   = "$Windows NT$"
Class       = "ActivityMonitor"
ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}
Provider    = %Malwarebytes%
DriverVer=10/12/2017,3.0.0.116
CatalogFile=mbam.cat

[DestinationDirs]
DefaultDestDir = 12
Rtp.DriverFiles = 12                        ;%windir%\system32\drivers

;;
;; Default install sections
;;
[DefaultInstall]
OptionDesc          = %RtpServiceDesc%
CopyFiles           = Rtp.DriverFiles

[DefaultInstall.Services]
AddService          = %RtpServiceName%,,Rtp.Service

;;
;; Default uninstall sections
;;
[DefaultUninstall]
DelFiles   = Rtp.DriverFiles
DelReg     = Rtp.DelRegistry

[DefaultUninstall.Services]
DelService = %RtpServiceName%,0x200      ;Ensure service is stopped before deleting

;
; Services Section
;
[Rtp.Service]
DisplayName      = %RtpServiceName%
Description      = %RtpServiceDesc%
ServiceBinary    = %12%\mbam.sys ;%windir%\system32\drivers\mbam.sys
Dependencies     = %FltmgrServiceName%               ;FltMgr
ServiceType      = 1                                 ;SERVICE_KERNEL_DRIVER
StartType        = 3                                 ;SERVICE_DEMAND_START
ErrorControl     = 1                                 ;SERVICE_ERROR_NORMAL
LoadOrderGroup   = "FSFilter Activity Monitor"
AddReg           = Rtp.AddRegistry

;
; Registry Modifications
;
[Rtp.AddRegistry]
HKR,%RegInstancesSubkeyName%,%RegDefaultInstanceValueName%,0x00000000,%DefaultInstance%
HKR,%RegInstancesSubkeyName%"\"%Instance1.Name%,%RegAltitudeValueName%,0x00000000,%Instance1.Altitude%
HKR,%RegInstancesSubkeyName%"\"%Instance1.Name%,%RegFlagsValueName%,0x00010001,%Instance1.Flags%

[Rtp.DelRegistry]

;
; Copy Files
;

[Rtp.DriverFiles]
mbam.sys

[SourceDisksFiles]
mbam.sys = 1

[SourceDisksNames]
1 = %Disk1%

;;
;; String Section
;;
[Strings]
Malwarebytes                        = "Malwarebytes"
RtpServiceDesc                      = "Malwarebytes Anti-Malware Real-Time Protection"
RtpServiceName                      = "MBAMProtection"
FltmgrServiceName                   = "FltMgr"
RegInstancesSubkeyName              = "Instances"
RegDefaultInstanceValueName         = "DefaultInstance"
RegAltitudeValueName                = "Altitude"
RegFlagsValueName                   = "Flags"
Disk1                               = "RealtimeProtectionKernel Source Media"

;Instances specific information.
DefaultInstance      = "MBAMProtection"
Instance1.Name       = "MBAMProtection"
Instance1.Altitude   = "328800"
Instance1.Flags      = 0x0