Hello,
I try to Get Message from my minifilter with FilterGetMessage.
I manage to recover a structure. But as soon as I put an array in my structure it no longer works. For example if I declare an array of 128 CHAR and initialize all the boxes at ‘c’. Once received this table is truncated. I only get 111 instead of 128 …
Userland.c :
typedef struct _SCANNER_NOTIFICATION {
int someData;
LONGLONG ScanId;
ULONG ScanThreadId;
CHAR MessageBuffer[128]; /* message text */
} SCANNER_NOTIFICATION;
typedef struct _SCANNER_MESSAGE {
FILTER_MESSAGE_HEADER MessageHeader;
SCANNER_NOTIFICATION Notification;
} SCANNER_MESSAGE, * PSCANNER_MESSAGE;
#define SCANNER_MESSAGE_SIZE (sizeof(FILTER_MESSAGE_HEADER) + sizeof(SCANNER_NOTIFICATION))
PSCANNER_MESSAGE message;
message = (PSCANNER_MESSAGE)HeapAlloc(GetProcessHeap(), 0, sizeof(SCANNER_MESSAGE));
FillMemory(&message->Ovlp, sizeof(OVERLAPPED), 0);
CHAR* string;
HRESULT hr = NULL;
while(1)
{
hr = FilterGetMessage(port,
&message->MessageHeader,
SCANNER_MESSAGE_SIZE,
NULL);
if (hr == S_OK) {
string = message->Notification.MessageBuffer;
sprintf_s(buffer, "%d | %s \n", strlen(string), string);
OutputDebugStringA(buffer);
}
}
And Kernel code :
typedef struct _SCANNER_NOTIFICATION {
int someData;
CHAR MessageBuffer[128]; /* message text */
INT iLengthContents;
LONGLONG ScanId;
ULONG ScanThreadId;
} SCANNER_NOTIFICATION;
SCANNER_NOTIFICATION notification = { 0 };
memset(notification.MessageBuffer, tag, 128);
memcpy(¬ification.MessageBuffer, MsgToCopy, strlen(MsgToCopy) - 1);
notification.MessageBuffer[sizeof(notification.MessageBuffer) - 1] = 0x00;
status = FltSendMessage(Data.FilterHandle, &DataClientPort, ¬ification, sizeof(SCANNER_NOTIFICATION), NULL, NULL, &timeout);
Anyone have an idea please?