Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

DnsGetCacheDataTable : Get Local DNS records at kernel mode

LearnerLearner Member Posts: 7
edited August 2023 in NTDEV

I am new to this kernel space programming, although worked bit on user mode, please excuse my question if its too basic.
I have kernel mode WFP d``river driver, I am trying to Get all DNS entries on system in kernel mode.
I know there is user mode API DnsGetCacheDataTable which gives me list of DNS records on system.
I am similar looking for kernel mode equivalent to get DNS records cached.
I found WskGetAddressInfo which gives name resolution, but did not routine to capture list of all DNS records at kernel mode

Tried to dissemble DnsGetCacheDataTable to check underneath kernel routine call, but looks like usermode DnsGetCacheDataTable calls DNSClient service, does not look like any kernel mode call

00007ffb`b7d99d9b 488d0dbe620300  lea     rcx,[DNSAPI!WPP_SF_qqdd <PERF> (DNSAPI+0x70060) (00007ffb`b7dd0060)]
00007ffb`b7d99da2 ff15e8d20500    call    qword ptr [DNSAPI!_imp_NdrClientCall3 (00007ffb`b7df7090)]


  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,831
    edited August 2023

    Are you saying you want to access the cached DNS data that already exists, or are you saying you want to intercept all DNS requests from now on?

    Tim Roberts, [email protected]
    Software Wizard Emeritus

  • MBond2MBond2 Member Posts: 705

    Inspecting the DNS cache in KM is an odd thing to want to do. Is there a larger goal that you are trying to achieve?

  • LearnerLearner Member Posts: 7

    Hi Tim,
    I want to access cached DNS records already.

    I am capturing DNS request/answers using WFP driver. I do not have DNS records those have already cached on the system, so wanted to enumerate already cached records

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,678
    edited August 2023

    No way from kernel mode. The cache is stored in the DNS Client service and only accessible to user mode.


  • MBond2MBond2 Member Posts: 705

    why not flush the DNS cache after you start tracing the responses in your filter? Ipconfig /flushdns

  • LearnerLearner Member Posts: 7

    Thanks Scott and MBond2.

    Flushing DNS records seems good option.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online