Hi
I am new to this kernel space programming, although worked bit on user mode, please excuse my question if its too basic.
I have kernel mode WFP d``river driver, I am trying to Get all DNS entries on system in kernel mode.
I know there is user mode API DnsGetCacheDataTable which gives me list of DNS records on system.
I am similar looking for kernel mode equivalent to get DNS records cached.
I found WskGetAddressInfo which gives name resolution, but did not routine to capture list of all DNS records at kernel mode
Tried to dissemble DnsGetCacheDataTable to check underneath kernel routine call, but looks like usermode DnsGetCacheDataTable calls DNSClient service, does not look like any kernel mode call
00007ffb`b7d99d9b 488d0dbe620300 lea rcx,[DNSAPI!WPP_SF_qqdd <PERF> (DNSAPI+0x70060) (00007ffb`b7dd0060)]
00007ffb`b7d99da2 ff15e8d20500 call qword ptr [DNSAPI!_imp_NdrClientCall3 (00007ffb`b7df7090)]