Re: Event betweens a console application and a UMDF driver ?

NTDEV
1

McDonald, Alastair wrote:

I want to share events between my console application and a UMDF driver.

If I create the events in the application and then try to open them in
the UMDF driver I get

Error message 02 – Error_File_Not_Found.

I assume you are using named events? Did you add the Global\ prefix?
UMDF drivers run in a special context.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

2

Yes - I have tried with the Global\ prefix. Unfortunately no luck.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: 15 January 2008 18:49
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Event betweens a console application and a UMDF
driver ?

McDonald, Alastair wrote:

I want to share events between my console application and a UMDF
driver.

If I create the events in the application and then try to open them in

the UMDF driver I get

Error message 02 - Error_File_Not_Found.

I assume you are using named events? Did you add the Global\ prefix?
UMDF drivers run in a special context.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

McDonald, Alastair wrote:

Yes - I have tried with the Global\ prefix. Unfortunately no luck.

Are you specifying a security descriptor when you call CreateEvent?
(That’s a loaded question; NO ONE specifies a security descriptor when
they call CreateEvent…) UMDF drivers run in a low-privilege process.
Well, “low-privilege” is a bit misleading; it runs as a different user,
so it may be that the default security descriptor isn’t enough.

You may be about to embark on a wonderous journey into the dark and
mysterious world of DACLs.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

4

No - I am not specifying a security descriptor. Maybe I should look at
that.

Looks like a KMDF driver can access events created by a User Mode
application. Do you know if its possible to use the necessary Kernal
Mode functions from within a User Mode Driver eg
ObReferenceObjectByHandle or perhaps a different method of event style
communication between a UMDF driver and an application program.

Would prefer to stick with a UMDF if possible.

Regards
Alastair

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: 16 January 2008 17:38
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Event betweens a console application and a UMDF
driver ?

McDonald, Alastair wrote:

Yes - I have tried with the Global\ prefix. Unfortunately no luck.

Are you specifying a security descriptor when you call CreateEvent?
(That’s a loaded question; NO ONE specifies a security descriptor when
they call CreateEvent…) UMDF drivers run in a low-privilege process.

Well, “low-privilege” is a bit misleading; it runs as a different user,
so it may be that the default security descriptor isn’t enough.

You may be about to embark on a wonderous journey into the dark and
mysterious world of DACLs.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

Alastair Mcdonald wrote:

… or perhaps a different method of event style communication between
a UMDF driver and an application program.

Inverted call

6

McDonald, Alastair wrote:

No - I am not specifying a security descriptor. Maybe I should look at
that.

Looks like a KMDF driver can access events created by a User Mode
application. Do you know if its possible to use the necessary Kernal
Mode functions from within a User Mode Driver eg
ObReferenceObjectByHandle or perhaps a different method of event style
communication between a UMDF driver and an application program.

Would prefer to stick with a UMDF if possible.

No, the UMDF process is really just a user-mode app. Kernel APIs are
not available. Events should certainly be doable, once you get the
security worked out.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

7

I completely agree with chris here. it will be much easier for you in the short and long run to send an overlapped IOCTL to the umdf driver and pend it in the driver vs using shared events. You can implement the inverted call in dramatically less time than it will take you to get the shared events initially working.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, January 16, 2008 11:45 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Re: Event betweens a console application and a UMDF driver ?

Alastair Mcdonald wrote:

… or perhaps a different method of event style communication between
a UMDF driver and an application program.

Inverted call

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

8

The account in question is LocalService. However a security issue shouldn’t cause ERROR_FILE_NOT_FOUND, it should cause something like ERROR_ACCESS_DENIED.

-p

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: Wednesday, January 16, 2008 9:38 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Event betweens a console application and a UMDF driver ?

McDonald, Alastair wrote:

Yes - I have tried with the Global\ prefix. Unfortunately no luck.

Are you specifying a security descriptor when you call CreateEvent?
(That’s a loaded question; NO ONE specifies a security descriptor when
they call CreateEvent…) UMDF drivers run in a low-privilege process.
Well, “low-privilege” is a bit misleading; it runs as a different user,
so it may be that the default security descriptor isn’t enough.

You may be about to embark on a wonderous journey into the dark and
mysterious world of DACLs.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer