Hey Everyone,
Long time lurker, first time poster. I’m a hobbyist dev so I apologize if this is a dumb post. I am working on a project that has a requirement which has left me scratching my head. I would greatly appreciate any advice!
I am using a process creation callback (via PsSetCreateProccessNotifyRoutineEx2()
) to monitor for the creation of a specific process. The name of the target process, a UNICODE_STRING
, is initialized in DriverEntry
as a test value via RtlInitUnicodeString()
. I would like to give the user of my application to change the name of the application being monitored via an IRP. While implementing this, however, I have run into significant issues when trying to update the global UNICODE_STRING
despite my best efforts at mitigating what I believe to be the core issue.
Here’s my code stripped of irrelevant lines:
// header.h
UNICODE_STRING g_TargetFileName;
// driver.c
NTSTATUS DriverEntry(PDRIVER_OBJECT pDrObj, PUNICODE_STRING pRegPath)
{
<...>
// Initialize the global variable to track the target process
RtlInitUnicodeString(&g_szTargetImage, L"my_test_application.exe");
<...>
}
// ioctl.c
static NTSTATUS UpdateTargetProcess(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
<...>
PWSTR szNewTargetImage = (PWSTR)pIrp->AssociatedIrp.SystemBuffer;
<...>
// This is where the bug exists
RtlInitUnicodeString(&g_TargetFileName, szNewTargetImage);
<...>
}
Here is what I’ve tried:
Attempt 1: Use RtlInitUnicodeString()
to “reinitialize” the value.
Result: No crash but the value placed in the global variable is not populating properly (i.e. the process creation callback never sees processes spawning with a matching name).
Attempt 2: Use RtlInitUnicode()
string to initialize a new UNICODE_STRING
with the data sent from the user via their IRL. Then use RtlUnicodeString()
to copy the new string into the global.
Result: System crash (ATTEMPTED_WRITE_TO_READONLY_MEMORY
).
Attempt 3: Use the same technique as Attempt 2, but manually create the global UNICODE_STRING
with a call to ExAllocatePoolWithTag()
to put the sting in the non-paged pool.
Result: System crash (ATTEMPTED_WRITE_TO_READONLY_MEMORY
).
Attempt 4: Take the new target filename from the user and place it into a PWSTR
. Then update the global variable’s string pointer (PUNICODE_STRING->Buffer
) to point to this new value.
Result: No crash but the value copied now pointed to be the buffer appears corrupted. Nearly the same result as Attempt 1, but the value comes back as an invalid string when printing it with KdPrintEx()
.
I could use some help figuring out what the “right” way to update a global UNICODE_STRING
via an IRP would be.
Thanks in advance!