Minifilter communication with user app

NTFSD
1

Hello, I’m trying to communicate my Minifilter with a user application to send and process some messages,

I’m doing this with the FltCreateCommunicationPort routine and sending messages from the user with FilterSendMessage routine.

I know this is working because I can see the message printed but I am unable to copy the InputBuffer into a local PCHAR to work with, My MessageNotifyCallback is:

NTSTATUS MiniRecieveSend(PVOID PortCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG Reference) {
    NTSTATUS status;
    KdPrint(("DEBUG_CONN: Message recieved from user: %s \r\n"), (PCHAR)InputBuffer); //This prints the correct message
    KdPrint(("DEBUG_CONN: Buffer Length: %d \r\n"), InputBufferLength); //This prints the correct length of the message, that it is like 131
    KdPrint(("DEBUG_CONN: Buffer Length: %d \r\n"), InputBufferLength); //this prints a random number, always between 30-50
}

However, with this implementation:

NTSTATUS MiniRecieveSend(PVOID PortCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG Reference) {
    NTSTATUS status;
    PCHAR UserMessage= (PCHAR) ExAllocatePoolWithTag(NonPagedPool, 512, "1gaT");
    RtlCopyMemory(UserMessage, InputBuffer, InputBufferLength);
        
    KdPrint(("DEBUG_CONN: Message recieved from user: %s \r\n"), (PCHAR)InputBuffer); //This prints "DEBUG_CONN: Message recieved from user: „»taÕÿÿÀo»taÕÿÿ "
    KdPrint(("DEBUG_CONN: Buffer Length: %d \r\n"), InputBufferLength); //This prints a number like if `InputBufferLength` was Null (sometimes it is 32042389193792 and other times -123193429)
    KdPrint(("DEBUG_CONN: Buffer Length: %d \r\n"), InputBufferLength); //this prints a random number (from 30 to 50)
}

If I try to use the buffer after printing it for the first time, I cannot copy it succesfully

Can anyone help me with this error, why I am not able to copy the buffer into a local variable, is there something that I am missing?

Thank you very much for your time

2

Minispy sample will be helpful.