Minifilter -> user space communication port, are named pipes the underlying technology?

I’ve gotten minifilter communication to user space working using the built-in communication ports mechanism, which looks an awful lot like a named pipe. Does anyone know if that’s what’s being used under the covers? If so could I use any named pipe library to receive messages from the minifilter?

No named pipes, it just uses IRPs.

Interesting, so a minifilter creates IRPs to communicate to user mode, how does user mode access the information sent from the minifilter? I was under the impression user mode had no access to IRPs.

https://www.osronline.com/article.cfm^id=94.htm

1 Like