Minifilter communication port issue

NTFSD
1

Hi everyone, I am trying to pass data from kernel (minifilter) to a user mode application which i want to print in user mode application (simple c code). For this i am calling fltsendmessage function in minifilter which is to be received by filtergetmessage. i want to print data passed by minifilter to user mode and then again send data from user mode to kernel mode using filterreplymessage, communication for this is established but i am not understanding how data structure works from sending to receiving data. i mean minifilter is sending a pointer of PVOID, while receiver is receiving data type of FILTER_MESSAGE_HEADER. How can i print this data ?
If any pseudo code is their then it will be a great help.

2

Have you taken a look at this sample? It seems to do what you want.

1 Like
3

Thanks that helps

This is also a good read

4

The issue might be with struct and data handling. Ensure using FILTER_MESSAGE_HEADER followed by your data. You can get help from this short pseudo code:

typedef struct _MY_MESSAGE {
FILTER_MESSAGE_HEADER MessageHeader;
CHAR Data[256]; // Custom data
} MY_MESSAGE;

MY_MESSAGE msg;
strcpy(msg.Data, "Hello from Kernel!");
FltSendMessage(Filter, &msg, sizeof(msg), NULL, 0, NULL);

For user:

typedef struct _MY_MESSAGE {
FILTER_MESSAGE_HEADER MessageHeader;
CHAR Data[256];
} MY_MESSAGE;

MY_MESSAGE msg;
hr = FilterGetMessage(hPort, &msg, sizeof(msg), NULL);
printf("Received: %s\n", msg.Data);

// Reply to kernel
FilterReplyMessage(hPort, &msg, sizeof(msg));

Hope it help!