Where's the source code for "dpinst-amd64.exe"? (It's asking for admin credentials.)

[eabase]

Where's the source code for dpinst-amd64.exe?

If it's gonna ask me for admin credentials, and is supposedly used to download "drivers" for additional Arduino boards, I really wanna see it's source code.

• Other driver software generally doesn't ask for admin cred's to download drivers!
• To make it worse, it is downloaded after main install package is getting installed. Why the **** isn't it packaged with the installer, in the first place?

Additional context

The installer is trying to run with the following flags:

/LM - Legacy mode. Accepts unsigned driver packages and packages with missing files.  
      These packages won't install on the latest version of Windows.
/SA - Suppress the Add/Remove Programs entry normally created for each driver package.
/SW - Suppresses the Device Installation Wizard, the operating system might still pop-up user dialogs.

Here's the help file:

pinst-amd64.exe [/U INF-file][/S | /Q][/LM][/P][/F][/SH][/SA][/A][/PATH Path][/EL][/L LanguageID][/C][/D][/LogTitle Title][/SW][/? | /h | /help]

  /U INF-file    Uninstall a driver package (INF-file).
  /S | /Q        Silent (Quiet) mode. Suppresses the Device Installation Wizard and any dialogs popped-up by the operating system.
  /LM    Legacy mode. Accepts unsigned driver packages and packages with missing files. These packages won't install on the latest version of Windows.
  /P     Prompt if the driver package to be installed is not better than the current one.
  /F     Force install if the driver package is not better than the current one.
  /SH    Scans hardware for matching devices and only copies and installs those drivers for which a device is present. Only valid for Plug and Play drivers.
  /SA    Suppress the Add/Remove Programs entry normally created for each driver package.
  /A     Install all or none.
  /PATH Path     Search for driver packages under the given path.
  /EL    Enables all languages not explicitly listed in the XML file.
  /L LanguageID          Tries to use the given language in all UI. Useful for localization tests.
  /SE    Suppress the EULA.
  /C     Dump logging output to attached Console (Windows XP and above).
  /D     Delete driver binaries on uninstall.
  /SW    Suppresses the Device Installation Wizard, the operating system might still pop-up user dialogs.
  /? | /h | /help        Shows this help.

Issue checklist

• I searched for previous reports in the issue tracker
• My report contains all necessary details

[per1234]

Where's the source code for dpinst-amd64.exe?

It is a proprietary tool from Microsoft:

https://learn.microsoft.com/windows-hardware/drivers/install/difx-guidelines

it is downloaded after main install package is getting installed. Why the **** isn't it packaged with the installer, in the first place?

First of all, an overview:

On the first run after a fresh installation of Arduino IDE 2.x, the IDE automatically installs the "Arduino AVR Boards" platform. This automatic installation is done to provide beginners with everything they need to get started working on Arduino projects with the common boards right away, without first needing to learn how to use Boards Manager.

Arduino boards platforms may include a "post-install" script to perform arbitrary system configuration for the platform. If the platform contains a post-install script, the script is executed by Arduino IDE when the platform is installed via the Boards Manager system:

https://arduino.github.io/arduino-cli/dev/platform-specification/#post-install-script

The "Arduino AVR Boards" platform has a Windows post-install script (here). The script uses the Driver Package Installer tool (DPInst), which is bundled with the platform (here) it to install drivers for the platform's boards:

ArduinoCore-avr/post_install.bat

Lines 2 to 18 in c8c514c

	set ARGS=/LM /SW /SA
	if "%PROCESSOR_ARCHITECTURE%" == "AMD64" (
	drivers\dpinst-amd64.exe %ARGS%
	) ELSE IF "%PROCESSOR_ARCHITEW6432%" == "AMD64" (
	drivers\dpinst-amd64.exe %ARGS%
	) ELSE (
	drivers\dpinst-x86.exe %ARGS%
	)
	REM dpinst /PATH has problems with relative paths, so use absolute path.
	if "%PROCESSOR_ARCHITECTURE%" == "AMD64" (
	drivers\dpinst-amd64.exe /PATH "%cd%\drivers\gemma" %ARGS%
	) ELSE IF "%PROCESSOR_ARCHITEW6432%" == "AMD64" (
	drivers\dpinst-amd64.exe /PATH "%cd%\drivers\gemma" %ARGS%
	) ELSE (
	drivers\dpinst-x86.exe /PATH "%cd%\drivers\gemma" %ARGS%
	)

Now to answer your question: the reason Arduino IDE downloads the "Arduino AVR Boards" platform from the Internet on the first run after installation is so that the user will always get the latest version of the platform.

This design decision was based on hard won experience from the Arduino IDE 1.x, project. The "Arduino AVR Boards" platform is bundled with the Arduino IDE 1.x and this approach was found to be harmful both for the users and for the maintainers. It was harmful for the users because they would often end up with an outdated version of the "Arduino AVR Boards" platform, missing important fixes or enhancements, even though they installed the latest version of the IDE. It was harmful for the maintainers because they were sometimes forced to spend time making releases of the IDE solely for the purpose of distributing a new version of the "Arduino AVR Boards" platform, even though there was no need for a release from the perspective of the IDE application itself.

By separating the distribution of the IDE application and the platform in Arduino IDE 2.x, we avoid these problems, and we can use the existing platform distribution system that is Boards Manager, so the implementation and maintenance of the system is trivial.

[eabase]

@per1234
Fair enough, and thanks for taking your time to explain. However, you still didn't address the questions of (a) where is the source code and (b), why do you need admin rights to use it?

As for (a), the only comfort, although not fully realistic (as we can create hash collisions and fake hashes), is that, apparently, it was compiled back in 2008/9 by Microsoft. But has gone under all sorts of different names, since.

• https://www.virustotal.com/gui/file/c20a5d3f5be543a8e73cd25f9dbf14aa0fc4ba1fdc249ee4ff91d159d174d0ea/details

Some other names:

DPInstx64.exe
DPInstx64_exe
DPInst
DPInst.exe
DPInst64.exe
_0F44B70B5A8B4D1EAED61755511DED05
64 Bit Driver Installer.exe
DPInst_amd64.exe
dpinst-amd64.exe
dpinst.exe
dpinstx64.exe
dpinst64.exe
DpInst.exe
file_drivers_dpinst_amd64.exe_4
dpin2b65.rra
DpInst64.exe
bcmCBFC.tmp
Setup.exe
filCF41673B1E3B54AF753C4542E54A7F7E
DPInst64.exe (copy)
a_dpinst64.exe.5EEDBAB3_BFF1_4754_8E83_62390A11B247
a_dpinst64.exe.F9657095_E727_44D1_9A13_8B5675EA31A2
DPInst.exe (copy)
dpinst_AMD64.exe
dpinst_Windows_64.exe

The last and most important criticism is, why do you need to download and install several 100's of drivers to Arduino boards that you will most likely never use? All without informing or giving consent to/from the user. Nor is there any reasonable explanation. This is an extremely ignorant and dangerous breach of standard security guidelines.

[per1234]

you still didn't address the questions of (a) where is the source code

The source code is proprietary. It is locked away on Microsoft's internal server, only available to Microsoft's developers.

why do you need admin rights to use it?

Because it is installing drivers and doing that requires elevated permissions.

why do you need to download and install several 100's of drivers

Surely there aren't hundreds? You can see them here:

https://github.com/arduino/ArduinoCore-avr/tree/master/drivers

The drivers are installed so that the user's computer will recognize the serial port of their Arduino board when they connect it to their computer with a USB cable. We do this automatically in order to make the learning curve less steep. If the user was forced to manually install a driver to get their board to be recognized before they could even get started with the fun Arduino stuff, this would make it significantly less accessible to casual beginners. If you don't believe me, do a search on your favorite search engine for arduino ch340 driver to see examples of bad first experiences that are suffered when beginners are forced to install drivers themself (cheap derivative boards often use the WCH CH340 USB chip).

This is an extremely ignorant and dangerous breach of standard security guidelines.

If you don't feel comfortable with it, simply don't give DPInst permissions. You will need to manually install any missing drivers that are required for your board.