Menu
I'm about to write the following interaction:
When there is a process about to start, driver will notify user app and then it will wait for response from the app.
The app will decide whether or not to allow that process to be created normally or terminated immediately, and send its decision back to the driver.
Base on the decision from user app. The driver will then allow or block the process execution.
My question is: What is recommended way to notify user-mode app from driver and then make the driver wait for the response?
617
The filter manager supports communication between user mode and kernel mode through communication ports. The minifilter driver controls security on the port by specifying a security descriptor to be applied to the communication port object.
In kernel mode, the program has direct and unrestricted access to system resources. In user mode, the application program executes and starts. In user mode, a single process fails if an interrupt occurs. Kernel mode is also known as the master mode, privileged mode, or system mode.
Necessity of Dual Mode (User Mode and Kernel Mode) in Operating System. A running user program can accidentaly wipe out the operating system by overwriting it with user data. Multiple processes can write in the same system at the same time, with disastrous results.
There are three events at which the processor should switch to the kernel address space: (1) supervisor call (called a trap instruction on the PDP-11); (2) an interrupt; and (3) an illegal instruction.
For event notification, you can use a notification event. I.e. the kernel calls IoCreateNotificationEvent and KeSetEvent. The user calls KeWaitForSingleObject. For user-kernel message communication, you can use IOCTL.
Alternatively, you can just use a named pipe for both purpose.
P.S. You can't use PsSetCreateProcessNotifyRoutine() for your purpose because it's only for auditing, but not for prevention/cancellation.
73
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
