FilterGetMessage trunck my array

bob45

Hello,

I try to Get Message from my minifilter with FilterGetMessage.

I manage to recover a structure. But as soon as I put an array in my structure it no longer works. For example if I declare an array of 128 CHAR and initialize all the boxes at 'c'. Once received this table is truncated. I only get 111 instead of 128 ..

Userland.c :

typedef struct _SCANNER_NOTIFICATION {
    int someData;
    LONGLONG  ScanId;
    ULONG  ScanThreadId;
   CHAR MessageBuffer[128];   /* message text */
} SCANNER_NOTIFICATION;

typedef struct _SCANNER_MESSAGE {
    FILTER_MESSAGE_HEADER MessageHeader;
    SCANNER_NOTIFICATION Notification;
} SCANNER_MESSAGE, * PSCANNER_MESSAGE;
#define SCANNER_MESSAGE_SIZE   (sizeof(FILTER_MESSAGE_HEADER) + sizeof(SCANNER_NOTIFICATION))
PSCANNER_MESSAGE message;
message = (PSCANNER_MESSAGE)HeapAlloc(GetProcessHeap(), 0, sizeof(SCANNER_MESSAGE));

FillMemory(&message->Ovlp, sizeof(OVERLAPPED), 0);
CHAR* string;
 HRESULT hr = NULL;

while(1)
{
hr = FilterGetMessage(port,
            &message->MessageHeader,
           SCANNER_MESSAGE_SIZE,
            NULL);

 if (hr == S_OK) {
            string = message->Notification.MessageBuffer;
            sprintf_s(buffer, "%d | %s  \n", strlen(string), string);
            OutputDebugStringA(buffer);
        }
}

And Kernel code :

typedef struct _SCANNER_NOTIFICATION {
    int someData;
    CHAR MessageBuffer[128];   /* message text */
    INT iLengthContents;
    LONGLONG  ScanId;
    ULONG  ScanThreadId;
} SCANNER_NOTIFICATION;

SCANNER_NOTIFICATION notification = { 0 };

memset(notification.MessageBuffer, tag, 128);
memcpy(&notification.MessageBuffer, MsgToCopy, strlen(MsgToCopy) - 1);
notification.MessageBuffer[sizeof(notification.MessageBuffer) - 1] = 0x00;
status = FltSendMessage(Data.FilterHandle, &DataClientPort, &notification, sizeof(SCANNER_NOTIFICATION), NULL, NULL, &timeout);

Anyone have an idea please?