Your code clearly does not match what’s running on the target, note that the
debugger is pointing a blank line in your source (531).
Rebuild your code, copy over the new version, and turn on Driver Verifier.
-scott
OSR
@OSRDrivers
wrote in message news:xxxxx@ntfsd…
Ok. i understood.
WinDbg is pointing this
527: sizeof(“abcd”));
528:
529: rLength = KPSMON_REPLY_BUFFER_SIZE;
530:
531:
532: status = FltSendMessage(
533: kpsmonData.Filter,
534: &kpsmonData.ClientPort,
535: notification,
536: sizeof(KPSMON_NOTIFICATION),
Bug message is :
KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL (192)
A lock tracked by AutoBoost was acquired while executing at DISPATCH_LEVEL
or
above.
Arguments:
Arg1: ffffe001cedb1080, The address of the thread.
Arg2: ffffe001ce4dd7d8, The lock address.
Arg3: 0000000000000002, The IRQL at which the lock was acquired.
Arg4: 0000000000000000, Reserved.
here is my full code
structures :
typedef struct KPSMON_DATA {
//
// The filter handle that results from a call to
// FltRegisterFilter.
//
PDRIVER_OBJECT DriverObject;
PFLT_FILTER Filter;
PFLT_PORT ServerPort;
PFLT_PORT ClientPort;
PEPROCESS UserProcess;
} KPSMON_DATA, *PKPSMON_DATA;
typedef struct _KPSMON_NOTIFICATION
{
ULONG pId;
UCHAR MJCode[20];
BOOLEAN isWriteAccess;
INT PrePost;
__int64 fltobject;
}KPSMON_NOTIFICATION, *PKPSMON_NOTIFICATION;
typedef struct _KPSMON_REPLY
{
BOOLEAN rcvd;
}KPSMON_REPLY, *PKPSMON_REPLY;
typedef struct _KPSMON_STREAM_HANDLE_CONTEXT
{
BOOLEAN allowed;
}KPSMON_STREAM_HANDLE_CONTEXT, *PKPSMON_STREAM_HANDLE_CONTEXT;
#define KPSMON_REPLY_BUFFER_SIZE sizeof(FILTER_REPLY_HEADER) +
sizeof(KPSMON_REPLY)
driver code :
FLT_PREOP_CALLBACK_STATUS
kpsmonPreOperation(
Inout PFLT_CALLBACK_DATA Data,
In PCFLT_RELATED_OBJECTS FltObjects,
Flt_CompletionContext_Outptr PVOID *CompletionContext
)
{
UNREFERENCED_PARAMETER(CompletionContext);
kpsmonSendInformation(FltObjects, Data, PRE);
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
FLT_POSTOP_CALLBACK_STATUS
kpsmonPostOperation(
Inout PFLT_CALLBACK_DATA Data,
In PCFLT_RELATED_OBJECTS FltObjects,
In_opt PVOID CompletionContext,
In FLT_POST_OPERATION_FLAGS Flags
)
{
UNREFERENCED_PARAMETER(CompletionContext);
UNREFERENCED_PARAMETER(Flags);
kpsmonSendInformation(FltObjects, Data, POST);
return FLT_POSTOP_FINISHED_PROCESSING;
}
NTSTATUS
kpsmonSendInformation(
In PCFLT_RELATED_OBJECTS FltObjects,
In PFLT_CALLBACK_DATA Data,
In INT PreOrPost
)
{
PKPSMON_NOTIFICATION notification = NULL;
NTSTATUS status = STATUS_SUCCESS;
ULONG rLength;
LARGE_INTEGER timeout;
timeout.QuadPart = -(LONGLONG)10000000;
try
{
DbgPrint(“pID = %u, isWriteAccess = %s, PreOrPost = %s”,
FltGetRequestorProcessId(Data), FltObjects->FileObject->WriteAccess ? “true”
: “false”, (PreOrPost == 0) ? “PRE” : “POST”);
if (isConnected)
{
notification = ExAllocatePool(
NonPagedPool,
sizeof(KPSMON_NOTIFICATION));
if (!NT_SUCCESS(status))
{
leave;
}
notification->fltobject = (__int64)FltObjects;
notification->pId = FltGetRequestorProcessId(Data);
notification->isWriteAccess = FltObjects->FileObject->WriteAccess;
notification->PrePost = PreOrPost;
RtlCopyMemory(
¬ification->MJCode,
“Abcd”,
sizeof(“abcd”));
rLength = KPSMON_REPLY_BUFFER_SIZE;
status = FltSendMessage(
kpsmonData.Filter,
&kpsmonData.ClientPort,
notification,
sizeof(KPSMON_NOTIFICATION),
notification,
&rLength,
&timeout);
if (!NT_SUCCESS(status))
{
leave;
}
}
else
{
DbgPrint(“kpsmon: Not Connected!”);
}
}
finally
{
if (!NT_SUCCESS(status))
{
DbgPrint(“kpsmon: Send Message Failed, status 0x%X”, status);
}
}
return status;
}
user-mode code is exactly same as Microsoft’s scanner example code
this is github link : https://goo.gl/T11Ptr
