Accessing memory of one process from another

NTFSD
1

How can a pointer from one process be accessed from another?
The situation I have is this: I need to modify the Irp->UserBuffer data
returned from MJ DirectoryControl from the process of system worker
thread. I tried to map a MDL but the MmProbeAndLockPages raises an
exception if executed from that system thread.
The MJ DirectoryControl is executed at APC_LEVEL, but I need the
PASSIVE_LEVEL so I can call ZwCreateFile for each file enumerated in the
directory so I can tell if it encrypted or not, so I can change the
reported size.

Any suggestions will be appreciated.
Thanks

Daniel

2

MmProbeAndLockPages should be called in the original context, not system
worker thread. You can use MmGetSystemAddressForMdl(Safe) in any thread
context though.
I would suggest against this - fairly easy to understand why. Directory
enumeration can take too much time to finish.

Daniel Turcanu wrote:

How can a pointer from one process be accessed from another?
The situation I have is this: I need to modify the Irp->UserBuffer data
returned from MJ DirectoryControl from the process of system worker
thread. I tried to map a MDL but the MmProbeAndLockPages raises an
exception if executed from that system thread.
The MJ DirectoryControl is executed at APC_LEVEL, but I need the
PASSIVE_LEVEL so I can call ZwCreateFile for each file enumerated in the
directory so I can tell if it encrypted or not, so I can change the
reported size.

Any suggestions will be appreciated.
Thanks

Daniel

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

3

KeAttachProcess() / KeDetachProcess(), or their new , Win2k+ only, stackable
versions. But are you sure you have
to alter data into another address space ?

----- Original Message -----
From: “Daniel Turcanu”
To: “File Systems Developers”
Sent: Sunday, March 23, 2003 6:18 PM
Subject: [ntfsd] Accessing memory of one process from another

> How can a pointer from one process be accessed from another?
> The situation I have is this: I need to modify the Irp->UserBuffer data
> returned from MJ DirectoryControl from the process of system worker
> thread. I tried to map a MDL but the MmProbeAndLockPages raises an
> exception if executed from that system thread.
> The MJ DirectoryControl is executed at APC_LEVEL, but I need the
> PASSIVE_LEVEL so I can call ZwCreateFile for each file enumerated in the
> directory so I can tell if it encrypted or not, so I can change the
> reported size.
>
> Any suggestions will be appreciated.
> Thanks
>
> Daniel
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>