Couldn't OpenEvent which created by IoCreateNotificationEvent in driver??

NTDEV
1

Hello Everyone:

http://www.osronline.com/article.cfm?id=108

Follow this article, I tried to create a share event in driver for
User-Mode app and driver. But when I tried to use OpenEvent or
CreateEvent to access the event object. I got 0x00000005 error ( Access
Deny) . If I created the event in User-Mode app and open it in driver,
both driver and app can access it without problem.

Here attached parts codes, please help me : Thank you in advance!

Driver Part:

RtlInitUnicodeString(&EventName, L"\BaseNamedObjects\ShareEvent");
SharedEvent = IoCreateNotificationEvent(&EventName, &
SharedEventHandle);
if (SharedEvent != NULL) {
ntStatus = STATUS_SUCCESS;
} else {
ntStatus = STATUS_UNSUCCESSFUL;
}

KeClearEvent(SharedEvent);
ntStatus = ObReferenceObjectByHandle( SharedEventHandle,
EVENT_ALL_ACCESS,
NULL,
KernelMode,
&EventHandle,
NULL );

App part:

// m_Handle = OpenEvent( EVENT_ALL_ACCESS,TRUE,“ShareEvent”);
m_Handle = CreateEvent( NULL,TRUE,FALSE,“ShareEvent”);

Best Regards

Haikun
2006-3-9

2

A much better way is to create the nameless event from user mode and pass
the handle to the driver via IOCTL.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Haikun Hou”
To: “Windows System Software Devs Interest List”
Sent: Thursday, March 09, 2006 12:03 PM
Subject: [ntdev] Couldn’t OpenEvent which created by IoCreateNotificationEvent
in driver??

> Hello Everyone:
>
> http://www.osronline.com/article.cfm?id=108
>
> Follow this article, I tried to create a share event in driver for
> User-Mode app and driver. But when I tried to use OpenEvent or
> CreateEvent to access the event object. I got 0x00000005 error ( Access
> Deny) . If I created the event in User-Mode app and open it in driver,
> both driver and app can access it without problem.
>
> Here attached parts codes, please help me : Thank you in advance!
>
> Driver Part:
>
> RtlInitUnicodeString(&EventName, L"\BaseNamedObjects\ShareEvent");
> SharedEvent = IoCreateNotificationEvent(&EventName, &
> SharedEventHandle);
> if (SharedEvent != NULL) {
> ntStatus = STATUS_SUCCESS;
> } else {
> ntStatus = STATUS_UNSUCCESSFUL;
> }
>
> KeClearEvent(SharedEvent);
> ntStatus = ObReferenceObjectByHandle( SharedEventHandle,
> EVENT_ALL_ACCESS,
> NULL,
> KernelMode,
> &EventHandle,
> NULL );
>
> App part:
>
> // m_Handle = OpenEvent( EVENT_ALL_ACCESS,TRUE,“ShareEvent”);
> m_Handle = CreateEvent( NULL,TRUE,FALSE,“ShareEvent”);
>
> Best Regards
>
> Haikun
> 2006-3-9
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Have a look at Microsoft Knowledge Base Article 228785 - OpenEvent Fails in a Non-Administrator Account

( http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q228785)

with detailed explanation of your problem.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]On Behalf Of Haikun Hou
Sent: Thursday, March 09, 2006 11:04 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Couldn’t OpenEvent which created by IoCreateNotificationEvent in driver??

Hello Everyone:

http://www.osronline.com/article.cfm?id=108

Follow this article, I tried to create a share event in driver for User-Mode app and driver. But when I tried to use OpenEvent or CreateEvent to access the event object. I got 0x00000005 error ( Access Deny) . If I created the event in User-Mode app and open it in driver, both driver and app can access it without problem.

Here attached parts codes, please help me : Thank you in advance!

Driver Part:

RtlInitUnicodeString(&EventName, L"\BaseNamedObjects\ShareEvent");
SharedEvent = IoCreateNotificationEvent(&EventName, & SharedEventHandle);
if (SharedEvent != NULL) {
ntStatus = STATUS_SUCCESS;
} else {
ntStatus = STATUS_UNSUCCESSFUL;
}

KeClearEvent(SharedEvent);
ntStatus = ObReferenceObjectByHandle( SharedEventHandle,
EVENT_ALL_ACCESS,
NULL,
KernelMode,
&EventHandle,
NULL );

App part:

// m_Handle = OpenEvent( EVENT_ALL_ACCESS,TRUE,“ShareEvent”);
m_Handle = CreateEvent( NULL,TRUE,FALSE,“ShareEvent”);

Best Regards

Haikun
2006-3-9

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

> A much better way is to create the nameless event from user mode and pass

the handle to the driver via IOCTL.
To the OP: this is what Oney describes and Microsoft recommends, see
http://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/KM-UMGuide.doc

----- Original Message -----
From: “Maxim S. Shatskih”
To: “Windows System Software Devs Interest List”
Sent: Thursday, March 09, 2006 5:10 AM
Subject: Re: [ntdev] Couldn’t OpenEvent which created by
IoCreateNotificationEvent in driver??

> A much better way is to create the nameless event from user mode and
> pass
> the handle to the driver via IOCTL.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “Haikun Hou”
> To: “Windows System Software Devs Interest List”
> Sent: Thursday, March 09, 2006 12:03 PM
> Subject: [ntdev] Couldn’t OpenEvent which created by
> IoCreateNotificationEvent
> in driver??
>
>
>> Hello Everyone:
>>
>> http://www.osronline.com/article.cfm?id=108
>>
>> Follow this article, I tried to create a share event in driver for
>> User-Mode app and driver. But when I tried to use OpenEvent or
>> CreateEvent to access the event object. I got 0x00000005 error ( Access
>> Deny) . If I created the event in User-Mode app and open it in driver,
>> both driver and app can access it without problem.
>>
>> Here attached parts codes, please help me : Thank you in advance!
>>
>> Driver Part:
>>
>> RtlInitUnicodeString(&EventName, L"\BaseNamedObjects\ShareEvent");
>> SharedEvent = IoCreateNotificationEvent(&EventName, &
>> SharedEventHandle);
>> if (SharedEvent != NULL) {
>> ntStatus = STATUS_SUCCESS;
>> } else {
>> ntStatus = STATUS_UNSUCCESSFUL;
>> }
>>
>> KeClearEvent(SharedEvent);
>> ntStatus = ObReferenceObjectByHandle( SharedEventHandle,
>> EVENT_ALL_ACCESS,
>> NULL,
>> KernelMode,
>> &EventHandle,
>> NULL );
>>
>> App part:
>>
>> // m_Handle = OpenEvent( EVENT_ALL_ACCESS,TRUE,“ShareEvent”);
>> m_Handle = CreateEvent( NULL,TRUE,FALSE,“ShareEvent”);
>>
>> Best Regards
>>
>> Haikun
>> 2006-3-9
>>
>>
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>>
>> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

5

IIRC, this is also what the osronline article recommneds. It shows
various ways of doing it and describes the pros and cons of each way and
ends with this recommendation.

To the OP: Go back and re-read the last paragraph in that article.

Beverly

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@Home
Sent: Thursday, March 09, 2006 7:01 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Couldn’t OpenEvent which created by
IoCreateNotificationEvent in driver??

A much better way is to create the nameless event from user mode and
pass the handle to the driver via IOCTL.
To the OP: this is what Oney describes and Microsoft recommends, see
http://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92c
dfeae4b45/KM-UMGuide.doc

----- Original Message -----
From: “Maxim S. Shatskih”
To: “Windows System Software Devs Interest List”
Sent: Thursday, March 09, 2006 5:10 AM
Subject: Re: [ntdev] Couldn’t OpenEvent which created by
IoCreateNotificationEvent in driver??

> A much better way is to create the nameless event from user mode
> and pass the handle to the driver via IOCTL.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “Haikun Hou”
> To: “Windows System Software Devs Interest List”
> Sent: Thursday, March 09, 2006 12:03 PM
> Subject: [ntdev] Couldn’t OpenEvent which created by
> IoCreateNotificationEvent in driver??
>
>
>> Hello Everyone:
>>
>> http://www.osronline.com/article.cfm?id=108
>>
>> Follow this article, I tried to create a share event in driver for
>> User-Mode app and driver. But when I tried to use OpenEvent or
>> CreateEvent to access the event object. I got 0x00000005 error (
Access
>> Deny) . If I created the event in User-Mode app and open it in
driver,
>> both driver and app can access it without problem.
>>
>> Here attached parts codes, please help me : Thank you in advance!
>>
>> Driver Part:
>>
>> RtlInitUnicodeString(&EventName, L"\BaseNamedObjects\ShareEvent");
>> SharedEvent = IoCreateNotificationEvent(&EventName, &
>> SharedEventHandle); if (SharedEvent != NULL) {
>> ntStatus = STATUS_SUCCESS;
>> } else {
>> ntStatus = STATUS_UNSUCCESSFUL;
>> }
>>
>> KeClearEvent(SharedEvent);
>> ntStatus = ObReferenceObjectByHandle( SharedEventHandle,
>> EVENT_ALL_ACCESS,
>> NULL,
>> KernelMode,
>> &EventHandle,
>> NULL );
>>
>> App part:
>>
>> // m_Handle = OpenEvent( EVENT_ALL_ACCESS,TRUE,“ShareEvent”);
>> m_Handle = CreateEvent( NULL,TRUE,FALSE,“ShareEvent”);
>>
>> Best Regards
>>
>> Haikun
>> 2006-3-9
>>
>>
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>>
>> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer