Calling application function From device Driver

NTDEV
1

hi all,
My question is is there a possibility that application can pass My
driver a Pointer to function and my Driver can execute it.

thanks
ajitabh

2

Generally speaking, it can, but it breaks security, raises context problems
and so on.
You should not do such a thing. If your design requires such, its most
likely broken.

Dan

----- Original Message -----
From: “Saxena, Ajitabh Prakash”
To: “NT Developers Interest List”
Sent: Friday, August 02, 2002 6:47 PM
Subject: [ntdev] Calling application function From device Driver

> hi all,
> My question is is there a possibility that application can pass My
> driver a Pointer to function and my Driver can execute it.
>
>
> thanks
> ajitabh
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

3

Yes

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Saxena, Ajitabh
Prakash
Sent: Friday, August 02, 2002 8:48 AM
To: NT Developers Interest List
Subject: [ntdev] Calling application function From device Driver

hi all,
My question is is there a possibility that application can pass
My
driver a Pointer to function and my Driver can execute it.

thanks
ajitabh

You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

4

No. The driver and the application are in two different trust domains. You
don’t want the driver to trust the application’s pointer. You have to use
the appropriate WIN32 IO interfaces (IOCTL, READ/WRITE).

–
Nar Ganapathy
Windows Core OS group
This posting is provided “AS IS” with no warranties, and confers no rights.

“Saxena, Ajitabh Prakash” wrote in message
news:xxxxx@ntdev…
>
> hi all,
> My question is is there a possibility that application can pass My
> driver a Pointer to function and my Driver can execute it.
>
>
> thanks
> ajitabh
>
>
>

5

It is possible. I have done it myself to see if it would work. There are
some caveats. For example, I would create a system thread in the
user-mode process from the driver and only use the pointer in that
context.

Nar is correct in that you violate all sorts of security and protection
mechanisms. Not a good idea to have production code giving ring 3
applications ring 0 access. However, it is possible.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Nar Ganapathy[MS]
Sent: Friday, August 02, 2002 10:26 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Calling application function From device Driver

No. The driver and the application are in two different trust domains.
You
don’t want the driver to trust the application’s pointer. You have to
use
the appropriate WIN32 IO interfaces (IOCTL, READ/WRITE).

–
Nar Ganapathy
Windows Core OS group
This posting is provided “AS IS” with no warranties, and confers no
rights.

“Saxena, Ajitabh Prakash” wrote in message
news:xxxxx@ntdev…
>
> hi all,
> My question is is there a possibility that application can pass My
> driver a Pointer to function and my Driver can execute it.
>
>
> thanks
> ajitabh
>
>
>

—
You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

6

Ajitabh,

The July 1999 issue of Microsoft Systems Journal (MSDN Mag) contains a
column titled “Nerditorium” by Jim Finnegan that covers this topic in great
detail. The author used a user-mode Asynchronous Procedure Call (APC),
which meant the application had to be in an altertable state, if it wanted
to process the APC. He uses two exported; but undocumented calls:
KeInitializeApc() and KeInsertQueueApc().

Jim also covers the other, more conventional methods of notifying your
application.

Search your MSDN Library CD for the article.

  • Joel

“Saxena, Ajitabh Prakash” wrote in message
news:xxxxx@ntdev…
>
> hi all,
> My question is is there a possibility that application can pass My
> driver a Pointer to function and my Driver can execute it.
>
>
> thanks
> ajitabh
>
>
>

7

As others have answered your question directly, it would be helpful to ask
why you want to do this? Tell us what you are trying to accomplish. There
is most certainly a better way to solve your problem.

–
Bill McKenzie
Windows DDK MVP
OSR - Windows System Software Development, Training, and Consulting

“Saxena, Ajitabh Prakash” wrote in message
news:xxxxx@ntdev…
>
> hi all,
> My question is is there a possibility that application can pass My
> driver a Pointer to function and my Driver can execute it.
>
>
> thanks
> ajitabh
>
>
>

8

> My question is is there a possibility that application can pass My

driver a Pointer to function and my Driver can execute it.

Impossible without really nasty tricks which will violate the system
stability.

Max

9

> some caveats. For example, I would create a system thread in the

user-mode process from the driver and only use the pointer in that
context.

Another great idea is to allocate huge amounts of memory in System
process’ user address space.
This memory can be a “super paged pool” and directly accessible from
kmode code running in System process context (PnP/Power paths and
ExQueueWorkItem callbacks).

Max

10

>

Another great idea is to allocate huge amounts of memory in System
process’ user address space.

And how to do it? Should memory be allocated from service?
What’s the earliest stage of Windows boot up it is possible to do?

This memory can be a “super paged pool” and directly accessible from
kmode code running in System process context (PnP/Power paths and
ExQueueWorkItem callbacks).

Max

Could you, please, provide some details?

Thx
Andrew

11

Create and map a section using the kernel system processes user space;
which is not allocated.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew
Sent: Monday, August 05, 2002 8:21 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Calling application function From device Driver

Another great idea is to allocate huge amounts of memory in System
process’ user address space.

And how to do it? Should memory be allocated from service?
What’s the earliest stage of Windows boot up it is possible to do?

This memory can be a “super paged pool” and directly accessible from
kmode code running in System process context (PnP/Power paths and
ExQueueWorkItem callbacks).

Max

Could you, please, provide some details?

Thx
Andrew

You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

12

> And how to do it? Should memory be allocated from service?

No, ZwCreateSection with NULL file handle, then ZwMapViewOfSection
from kernel-mode driver.

Services are just usual user processes, nothing special in them except
that they are not associated with interactive logon session and window
station.

Max

13

Thx
Do you imply to use undocumented ZwCreateSection and ZwMapViewOfSection
in some driver DriverEntry routine(which is called in a system process
context)?

Create and map a section using the kernel system processes user space;
which is not allocated.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew
Sent: Monday, August 05, 2002 8:21 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Calling application function From device Driver

>
> Another great idea is to allocate huge amounts of memory in System
> process’ user address space.
>

And how to do it? Should memory be allocated from service?
What’s the earliest stage of Windows boot up it is possible to do?
>
> This memory can be a “super paged pool” and directly accessible from
> kmode code running in System process context (PnP/Power paths and
> ExQueueWorkItem callbacks).
>
> Max

Could you, please, provide some details?

Thx
Andrew

You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

14

Exactly!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew
Sent: Monday, August 05, 2002 2:06 PM
To: NT Developers Interest List
Subject: [ntdev] Re: Calling application function From device Driver

Thx
Do you imply to use undocumented ZwCreateSection and ZwMapViewOfSection
in some driver DriverEntry routine(which is called in a system process
context)?

Create and map a section using the kernel system processes user space;
which is not allocated.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew
Sent: Monday, August 05, 2002 8:21 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Calling application function From device Driver

>
> Another great idea is to allocate huge amounts of memory in System
> process’ user address space.
>

And how to do it? Should memory be allocated from service?
What’s the earliest stage of Windows boot up it is possible to do?
>
> This memory can be a “super paged pool” and directly accessible from
> kmode code running in System process context (PnP/Power paths and
> ExQueueWorkItem callbacks).
>
> Max

Could you, please, provide some details?

Thx
Andrew

You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

15

Yeh, silly me, did not wake up yet.
Thank you, Max

> And how to do it? Should memory be allocated from service?

No, ZwCreateSection with NULL file handle, then ZwMapViewOfSection
from kernel-mode driver.

Services are just usual user processes, nothing special in them except
that they are not associated with interactive logon session and window
station.

Max

MSN Photos is the easiest way to share and print your photos:
http://photos.msn.com/support/worldwide.aspx