FilterGetMessage message size

NTDEV
1

Hi,

I am trying to consume a message in the user mode code by calling FilterGetMessage which I sent from my minifilter by calling FltSendMessage. This works great if I know the size ahead of time but in the case of dynamic sizes this is difficult to know ahead of time. My understanding is that I need to use the OVERLAPPED structure and set the hEvent field. Then when I GetOverlappedResult it will return failure and GetLastError will return ERROR_INSUFFICIENT_BUFFER. This lets me re alloc and call again. However I am not able to retrieve the original message. The second call to GetOverlappedResult is blocked waiting for a new message and not returning the message I just allocated for. If a new message arrives (which will fit into my allocated buffer) I am able to retrieve the additional messages but the original message is gone. I am assuming that I am messing up the OVERLAPPED structure somehow but I am not understanding what I am missing.

Here is my code (copied and edited for simplicity)

FilterConnectCommunicationPort()
BYTE initialBuffer[sizeof(FILTER_MESSAGE_HEADER)]; // smallest payload

OVERLAPPED ov = {NULL};
      ov.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL)
hr = FilterGetMessage(port_, (PFILTER_MESSAGE_HEADER)initialBuffer, sizeof(initialBuffer),
                            &ov);

if(!GetOverlappedResult(hPort, &ov, &bytesReturned, TRUE)) {
  if( GetLastError() == ERROR_INSUFFICIENT_BUFFER) 
    // realloc buffer to bytesReturned

   ResetEvent(ov.hEvent);
  FilterGetMessage(hPort, message, requiredSize, &ov);

  // in this call GetOverlappedResult is blocked waiting for the event to get signaled but FilterGetMessage does not seem to signal it.
GetOverlappedResult(hPort, &ov, &bytesReturned, TRUE);
}

I read through this as well but did not see anything I am missing. Any pointers would be greatly appreciated.

2

That was a fun trip back to 2008! Apparently this is still not fixed and the best approach is to use a Really Big Buffer?

3

Thanks @Mark_Roddy I am just using a larger buffer now. I just figured that there was something that I was doing to cause this to not work. Thanks for the confirmation.