How to use FilterSendMessage to send strings?

NTFSD
1

Hi All,
I want to send a string which contains file extension information (mostly 4 characters long with the null character included) from the user mode, where the user inputs the extension to the filter driver, using FilterSendMessage…

Is it possible? How do I do it? I’m clueless about it … :frowning:

Thanks!

-saurako

2

Why so sad? :wink:

its not some undocumented architecture specific stuff. Just think that how a string will appear in memory and than notice that input parameter is a void *.

Aditya

3

> I want to send a string which contains file extension information

(mostly 4 characters long with the null character included) from the
user mode, where the user inputs the extension to the filter driver,
using FilterSendMessage…

Is it possible? How do I do it? I’m clueless about it … :frowning:

Yes, just open the communication port (using FilterConnectCommunicationPort)
that you have created from the minifilter (using FltCreateCommunicationPort)
and fire FilterSendMessage using the buffer containing whatever data you
want to!

Regards,
Ayush Gupta
AI Consulting

4

Thank you all for all the replies! I’m sorry for replying so late, I was out
of town…

I tried this:

In the filter I opened a port :
status = FltCreateCommunicationPort(Data.Filter,
&Data.ServerPort,
&oa,
NULL,
FunctionConnect,
FunctionDisconnect,
FunctionMessage,
1 );

I assume this opens properly because I see my filter loaded using fltmc.

In the user mode I send a message:
hResult = FilterSendMessage( port,
ext,
4,
sendbuffer,
sizeof(alignedBuffer),
&bytesReturned );
ext being a PUCHAR to the file extension string. (eg. to “exe”).

The message call back in the filter looks like this:

NTSTATUS
securityFunctionMessage (
__in PVOID ConnectionCookie,
__in_bcount_opt(InputBufferSize) PVOID InputBuffer,
__in ULONG InputBufferSize,
__out_bcount_part_opt(OutputBufferSize,*ReturnOutputBufferLength) PVOID
OutputBuffer,
__in ULONG OutputBufferSize,
__out PULONG ReturnOutputBufferLength
)
{
PUNICODE_STRING ext;
NTSTATUS status;
//UNICODE_STRING fileExtension;
PAGED_CODE();

UNREFERENCED_PARAMETER( ConnectionCookie );

if ((InputBuffer != NULL) &&
(InputBufferSize == 4)
) {
try {
ext = ((PUNICODE_STRING) InputBuffer);
RtlInitUnicodeString(&Extension, ext);
status = STATUS_SUCCESS;
} except( EXCEPTION_EXECUTE_HANDLER ) {

return GetExceptionCode();
}
}
return status;
}

Extension is a UNICODE_STRING which I want to set with the value of the
string being passed.

I get a blue screen with this code.

Can someone please tell me what I’m doing wrong?

-Saurabh

On Mon, Jan 18, 2010 at 9:28 AM, Ayush Gupta wrote:

> > I want to send a string which contains file extension information
> > (mostly 4 characters long with the null character included) from the
> > user mode, where the user inputs the extension to the filter driver,
> > using FilterSendMessage…
> >
> > Is it possible? How do I do it? I’m clueless about it … :frowning:
>
> Yes, just open the communication port (using
> FilterConnectCommunicationPort)
> that you have created from the minifilter (using
> FltCreateCommunicationPort)
> and fire FilterSendMessage using the buffer containing whatever data you
> want to!
>
> Regards,
> Ayush Gupta
> AI Consulting
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>