Well i have made a simple minifilter driver that monitors filesystem
activity, and registry activity and reports it to a rudimentary usermode
application. This is the send message function:
NTSTATUS
SfSendMessage(
__in PCWSTR processID, __in PCWSTR action, __in PUNICODE_STRING fullPath,
__in PUNICODE_STRING name
)
{
NTSTATUS status;
PSF_MESSAGE message = NULL;
int count, totalCount = 0;
message = (PSF_MESSAGE)ExAllocatePoolWithTag(NonPagedPool,
sizeof(SF_MESSAGE), SF_USR_MSG_POOL_TAG);
if(message == NULL)
return STATUS_INSUFFICIENT_RESOURCES;
for(totalCount = 0; processID[totalCount] != ‘\0’; totalCount++)
message->Contents[totalCount] = processID[totalCount];
message->Contents[totalCount++] = ‘#’;
for(count = 0; action[count] != ‘\0’; count++, totalCount++)
message->Contents[totalCount] = action[count];
message->Contents[totalCount++] = ‘#’;
for(count = 0; count < ((fullPath->Length) / 2) ; count++, totalCount++)
message->Contents[totalCount] = fullPath->Buffer[count];
if((name != NULL) && ((action == keyValueCreated) ||
(action == keyValueDeleted) ||
(action == keyValueModified) ||
(action == keyRenamed)))
{
if(action == keyRenamed)
message->Contents[totalCount++] = ‘#’;
else
message->Contents[totalCount++] = ‘\’;
for(count = 0; count < ((name->Length) / 2); count++, totalCount++)
message->Contents[totalCount] = name->Buffer[count];
}
message->Contents[totalCount++] = ‘#’;
message->Contents[totalCount] = ‘\0’;
if(totalCount >= 1536)
{
ExFreePoolWithTag(message, SF_USR_MSG_POOL_TAG);
return STATUS_INSUFFICIENT_RESOURCES;
}
status = FltSendMessage(SfData.FilterHandle,
&SfData.ClientPort,
message,
sizeof(SF_MESSAGE),
NULL,
NULL,
NULL);
ExFreePoolWithTag(message, SF_USR_MSG_POOL_TAG);
return status;
}
This function has been called at various places, to report the relevant
filesystem and registry activity. Now this is the rudimentary code for the
user mode application, where it recieves these messages:
int __cdecl main()
{
HRESULT hr;
HANDLE hComPort;
PSIMPLE_MESSAGE MessageEnvelop = NULL;
MessageEnvelop = (PSIMPLE_MESSAGE)malloc(sizeof(SIMPLE_MESSAGE));
cout<<“Client waiting to connect to the filter…\n”;
do
{
hr = FilterConnectCommunicationPort(SimplePortName, 0, NULL, 0, NULL,
&hComPort);
}
while(IS_ERROR(hr));
cout<<“Connected successfully!\n”;
while(1)
{
hr = FilterGetMessage(hComPort, &MessageEnvelop->MessageHeader,
sizeof(SIMPLE_MESSAGE), NULL);
if(!IS_ERROR(hr))
printf(“%ls\n\n”, MessageEnvelop->Message.Contents);
}
getchar();
return 0;
}
As you can see, it is very basic and only for the purpose of testing. Now
the situation is that the code runs fine, the driver runs fine, my exact
specified filesystem and registry activity is reported just how i want it
to. The only problem occurs that whenever i run an application that asks
for admin privileges (UAC turned on; windows 7 32-bit), the screen goes
black. I have connected WinDbg to the target windows 7 instance on VMWare
that i am deploying this driver on, but it shows no signs of error or
anything. Anyhow so i narrowed down the cause of the problem to this line:
while(1)
{
hr = FilterGetMessage(hComPort, &MessageEnvelop->MessageHeader,
sizeof(SIMPLE_MESSAGE), NULL);
if(!IS_ERROR(hr))
printf(“%ls\n\n”, MessageEnvelop->Message.Contents); //this line
}
The printf statement to be precise, if i comment it out, the screen does
not go black/get stuck, upon running an application with admin privileges
and everything always runs fine, except for the fact that i can’t display
my the reports through the usermode application offcourse. Although i can
obviously print them to debug, and thus everything runs fine.
So here is the obvious question, what is wrong here? what am i doing wrong?
Is it that FilterGetMessage recieves a message, but it hasn’t actually
received a message, or received a correct message, so that when i try to
access MessageEnvelop->Message.Contents, or rather display it, the screen
goes black, and it gets stuck and i have to power off and restart the
VMWare instance. Even though that the driver is obviously running fine,
there are no signs of errors on WinDbg either. The problem lies with
receiving the message from the driver and then trying to display it. And
only happens when Admin access is attempted for ANY program on the system.
Kindly help me out with this!
