Two-way interaction between user-mode app and kernel-mode driver?

Question

I'm about to write the following interaction:

• When there is a process about to start, driver will notify user app and then it will wait for response from the app.

• The app will decide whether or not to allow that process to be created normally or terminated immediately, and send its decision back to the driver.

• Base on the decision from user app. The driver will then allow or block the process execution.

My question is: What is recommended way to notify user-mode app from driver and then make the driver wait for the response?

Answer 1

For event notification, you can use a notification event. I.e. the kernel calls IoCreateNotificationEvent and KeSetEvent. The user calls KeWaitForSingleObject. For user-kernel message communication, you can use IOCTL.

Alternatively, you can just use a named pipe for both purpose.

P.S. You can't use PsSetCreateProcessNotifyRoutine() for your purpose because it's only for auditing, but not for prevention/cancellation.