sharing an event between kernel and user modes

NTDEV
1

I read your article :
Sharing Is Caring - Sharing Events Between Kernel-User Mode
The NT Insider - Vol 9, Issue 5, Sep-Oct 2002 | Published: 15-Oct-02|
Modified: 10-Oct-02

My experience is somewhat different.
1st I tried creating a name event in kernel mode, then opening it in user
mode and am getting an error: 5, ERROR_ACCESS_DENIED

The reason I’m trying to create the event in kernel mode and then pass it to
user mode is that I want the Event to be exposed to terminal sessions. I
need to broadcast my event to each terminal session when it occurs. For the
sake of symmetry I thought this would be the better way to go, but… And
if I create the Event in User mode, I get the same error!

I have created the event with IoCreateNotificationEvent in the
BaseNamedObjects namespace, but have not managed to Open the event in ANY
process or session?

BTW, I can see my Event in the BaseNamedObjects space with WinObj.

Using as a test platform XP / Home /SP 2

Created
in the kernel:
RtlInitUnicodeString(&KeEvNew,L"\BaseNamedObjects\MyEvent");

Event.MyEvent = IoCreateNotificationEvent(&KeEvNew,&Dummy);

in User mode:
Event=OpenEvent(NULL,FALSE,L"MyEvent");

One last point, you mention that \BaseNamedObjects does not exist at boot
time, yet you also mention that DriverEntry might be a good place to create
an event in that directory?

Any suggestions?

Thanks

Marley

2

Larry wrote:

I read your article :
Sharing Is Caring - Sharing Events Between Kernel-User Mode
The NT Insider - Vol 9, Issue 5, Sep-Oct 2002 | Published: 15-Oct-02|
Modified: 10-Oct-02

My experience is somewhat different.
1st I tried creating a name event in kernel mode, then opening it in user
mode and am getting an error: 5, ERROR_ACCESS_DENIED

The reason I’m trying to create the event in kernel mode and then pass it to
user mode is that I want the Event to be exposed to terminal sessions. I
need to broadcast my event to each terminal session when it occurs. For the
sake of symmetry I thought this would be the better way to go, but… And
if I create the Event in User mode, I get the same error!

Terminal Services introduces changes in the kernel namespace. If you
want something exposed to all terminal sessions, you need to use
\BaseNamedObjects\Global\YourEventName, with appropriate backslash
protection. User apps will still use the name YourEventName.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.