Sending large data from scanner minifilter to user mode

NTFSD
1

Hi,

I am working on a scanner minifilter (based on microsoft sample). In the default implementation of Pre-Write callback the notification structure contains 1 KB size for content buffer, which is then sent (fltsendmessage) to user mode application.
I need to access the data for a file before it is being created(hence using pre-write callback). I have noticed that the scanner receives chunks in size of max 65K bytes along with file position. I have tried the following to send this whole buffer.

typedef struct _SCANNER_NOTIFICATION {
first few members here …
INT iLengthContent;
CHAR szContent[1];
} SCANNER_NOTIFICATION;

iNotificationNewSize = FIELD_OFFSET(SCANNER_NOTIFICATION, szContent[iCurBufferSize]);
notification = ExAllocatePoolWithTag( NonPagedPool,iNotificationNewSize,‘nacS’ );

Then used RtlCopyMemory() to copy the contents into notification->szContent.
Everything is fine so far but in user mode here is the structure which I retrieve

typedef struct _SCANNER_MESSAGE {

FILTER_MESSAGE_HEADER MessageHeader;
SCANNER_NOTIFICATION Notification;
OVERLAPPED Ovlp;

} SCANNER_MESSAGE, *PSCANNER_MESSAGE;

The Notification object in this scanner_message contains only first 4 bytes for its szContent member(even though full buffer was copied into it in the scanner.sys).

The reason might be that during marshaling only sizeof(SCANNER_NOTIFICATION) is used and hence no data is received in the user mode or may be I am doing it all wrong.

Is there any other synchronous method available to send large chunks of data to user mode?

2

>>I need to access the data for a file before it is being created (hence using pre-write callback)

Needs more clarity on this statement, as this statement itself is not true. There has to be a create IRP to do something further on that file. you will not get any write for a given fileobject without a successful create.

>The reason might be that during marshaling only sizeof(SCANNER_NOTIFICATION) is used

You guessed it write, you need to specify actual number of bytes which you want to send to user mode app. so if your buffer has 1000 bytes and if you specify 500, than it will copy just 500(in fact no API can deduce the length of a pointer, we have to pass it correctly).

you are getting four bytes in szContent probably because sizeof returns padded size.

3

*probably* is not associated with sizeof. :slight_smile:

it surly returns padded length.