Hello everyone:
I want to know is it possible to share a kernel object, such as
Event/Samephore object between driver and application? As I understand,
to use SDK API in driver is not good, but I don’t know if this is
allowed ?
Any attention will be appreciated !
Haikun
2006-2-15
Yes you can. Create it in user mode, and pass the handle in the IOCTL input
buffer. In the driver, do ObReferenceObjectByHandle, and then cast the
resulting pointer to KEVENT or such.
Do not forget to ObDereference it later.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Haikun Hou”
To: “Windows System Software Devs Interest List”
Sent: Wednesday, February 15, 2006 4:59 AM
Subject: [ntdev] Is it possible to share kernel object between driver and
application?
> Hello everyone:
>
> I want to know is it possible to share a kernel object, such as
> Event/Samephore object between driver and application? As I understand,
> to use SDK API in driver is not good, but I don’t know if this is
> allowed ?
>
> Any attention will be appreciated !
>
> Haikun
>
> 2006-2-15
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Yes, it is.
In user mode:
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Haikun Hou
Sent: Wednesday, February 15, 2006 4:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Is it possible to share kernel object between driver
and application?
Hello everyone:
I want to know is it possible to share a kernel object, such as
Event/Samephore object between driver and application? As I understand,
to use SDK API in driver is not good, but I don’t know if this is
allowed ?
Any attention will be appreciated !
Haikun
2006-2-15
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Max and Yakov have done a good job of explaining how, but before you do it
think about the why. If you are waiting on an event or semaphore so you can
get some data, how are you going to get the data? If you have to call the
kernel to get the data, consider using an OVERLAPPED read or IOCTL request
which will be pended in the kernel till data is available. At that point
you complete the request and return to user space the data. In user space,
there are mechanisms for associating an event with the request so you can
wait on it.
Unless you are doing something very advanced, using a shared Event is not a
good idea. I have significantly improved driver / application performance
by replacing the shared event with standard OVERLAPPED approaches.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply
“Haikun Hou” wrote in message news:xxxxx@ntdev…
> Hello everyone:
>
> I want to know is it possible to share a kernel object, such as
> Event/Samephore object between driver and application? As I understand,
> to use SDK API in driver is not good, but I don’t know if this is
> allowed ?
>
> Any attention will be appreciated !
>
> Haikun
>
> 2006-2-15
>
It has been already explained how to “convert” a user-mode handle
into something usable in the kernel thru ObRefByHandle.
This is what Oney describes and Microsoft recommends, see
http://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/KM-UMGuide.doc
There is another approach (let’s leave overlapped ioctls alone for now), using named objects (events etc.),
see http://www.osronline.com/article.cfm?id=108.
Just out of interest: what’s wrong with this second approach,
CreateEvent(… , “i-will-open-this-event-in-the-kernel”),
paired with IoCreateNotificationEvent, except the obvious?
By “obvious” I mean (a) your naming convention may not be good enough, and (b) performance issues.
Ok, what else, if anything?
----- Original Message -----
From: Yakov Kaabak
To: Windows System Software Devs Interest List
Sent: Wednesday, February 15, 2006 10:26 AM
Subject: RE: [ntdev] Is it possible to share kernel object between driver and application?
Yes, it is.
In user mode:
Create event/semaphore
Send handle to your driver by DeviceIoControl
In driver:
Apply ObReferenceObjectByHandle to received handle (while in dispatch routine for the above DeviceIoControl)
Store the result (Object) and use it however you want (SetEvent, WaitForSingleObject etc)
When you no longer need it, call ObDereferenceObject on it.
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Haikun Hou
Sent: Wednesday, February 15, 2006 4:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Is it possible to share kernel object between driver and application?
Hello everyone:
I want to know is it possible to share a kernel object, such as Event/Samephore object between driver and application? As I understand, to use SDK API in driver is not good, but I don’t know if this is allowed ?
Any attention will be appreciated !
Haikun
2006-2-15
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
When you create a named event, it is only created in the object name space for your session (unless you put the right prefix on the name). You are also exposing yourself to another attack by an outside component by creating a named object. If you have an unnamed handle and pass it to the driver, there is no way for another app to open up the event object.
d
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@Home
Sent: Wednesday, February 15, 2006 8:00 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Is it possible to share kernel object between driver and application?
It has been already explained how to “convert” a user-mode handle
into something usable in the kernel thru ObRefByHandle.
This is what Oney describes and Microsoft recommends, see
http://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/KM-UMGuide.doc
?
There is another approach (let’s leave overlapped ioctls alone for now), using named objects (events etc.),
see?http://www.osronline.com/article.cfm?id=108.
?
Just out of interest: what’s wrong with this second approach,
CreateEvent(… , “i-will-open-this-event-in-the-kernel”),
paired with IoCreateNotificationEvent, except the obvious?
?
By “obvious” I mean?(a) your?naming convention may not be good enough, and (b) performance issues.
?
Ok, what else, if anything?
?
?
?
----- Original Message -----
From: Yakov Kaabak
To: Windows System Software Devs Interest List
Sent: Wednesday, February 15, 2006 10:26 AM
Subject: RE: [ntdev] Is it possible to share kernel object between driver and application?
Yes, it is.
In user mode:
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Haikun Hou
Sent: Wednesday, February 15, 2006 4:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Is it possible to share kernel object between driver and application?
Hello everyone:
I want to know is it possible to share a kernel object, such as Event/Samephore object between driver and application? As I understand, to use SDK API in driver is not good, but I don’t know if this is allowed ?
Any attention will be appreciated !
Haikun
2006-2-15
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
And when calling ObReferenceObjectByHandle, make sure to pass
*ExEventObjectType as the ObjectType (and not NULL) so that the OS can
verify that the handle you are referencing is really a KEVENT and not
some other type of handle.
d
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Yakov Kaabak
Sent: Wednesday, February 15, 2006 7:27 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Is it possible to share kernel object between
driver and application?
Yes, it is.
In user mode:
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Haikun Hou
Sent: Wednesday, February 15, 2006 4:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Is it possible to share kernel object between driver
and application?
Hello everyone:
I want to know is it possible to share a kernel object, such as
Event/Samephore object between driver and application? As I understand,
to use SDK API in driver is not good, but I don’t know if this is
allowed ?
Any attention will be appreciated !
Haikun
2006-2-15
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
> a named event, it is only created in the object name space for your
session (unless you put the right prefix on the name)
Ok, good point.
You are also exposing yourself to another attack by an outside
component by creating a named object
Oh! Forgot to mention it as “obvious”.
Thanx, Doron.
----- Original Message -----
From: “Doron Holan”
To: “Windows System Software Devs Interest List”
Sent: Wednesday, February 15, 2006 1:20 PM
Subject: RE: [ntdev] Is it possible to share kernel object between driver
and application?
When you create a named event, it is only created in the object name space
for your session (unless you put the right prefix on the name). You are
also exposing yourself to another attack by an outside component by creating
a named object. If you have an unnamed handle and pass it to the driver,
there is no way for another app to open up the event object.
d
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@Home
Sent: Wednesday, February 15, 2006 8:00 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Is it possible to share kernel object between driver
and application?
It has been already explained how to “convert” a user-mode handle
into something usable in the kernel thru ObRefByHandle.
This is what Oney describes and Microsoft recommends, see
http://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/KM-UMGuide.doc
There is another approach (let’s leave overlapped ioctls alone for now),
using named objects (events etc.),
see http://www.osronline.com/article.cfm?id=108.
Just out of interest: what’s wrong with this second approach,
CreateEvent(… , “i-will-open-this-event-in-the-kernel”),
paired with IoCreateNotificationEvent, except the obvious?
By “obvious” I mean (a) your naming convention may not be good enough, and
(b) performance issues.
Ok, what else, if anything?
----- Original Message -----
From: Yakov Kaabak
To: Windows System Software Devs Interest List
Sent: Wednesday, February 15, 2006 10:26 AM
Subject: RE: [ntdev] Is it possible to share kernel object between driver
and application?
Yes, it is.
In user mode:
1. Create event/semaphore
2. Send handle to your driver by DeviceIoControl
In driver:
1. Apply ObReferenceObjectByHandle to received handle (while in dispatch
routine for the above DeviceIoControl)
2. Store the result (Object) and use it however you want (SetEvent,
WaitForSingleObject etc)
3. When you no longer need it, call ObDereferenceObject on it.
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Haikun Hou
Sent: Wednesday, February 15, 2006 4:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Is it possible to share kernel object between driver and
application?
Hello everyone:
I want to know is it possible to share a kernel object, such as
Event/Samephore object between driver and application? As I understand, to
use SDK API in driver is not good, but I don’t know if this is allowed ?
Any attention will be appreciated !
Haikun
2006-2-15
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com