thank to all people who replay my thread!
now i’m try again copy data between user-app <-> WFP driver.
when i send deviceiocontrol() in user-application then wfp driver response about
“MONITOR_IOCTL_GET_EVENT” but i can’t handling about &networkEvent
my code flow is like this.
- user-application send devieio code
typedef struct _NETWORK_EVENT
{
TIME_FIELDS time;
ULONG localAddr;
ULONG remoteAddr;
USHORT localPort;
USHORT remotePort;
USHORT ipProto;
BOOLEAN inoutBound;
ULONG processId;
WCHAR procPath[1024];
}NETWORK_EVENT;
ZeroMemory(&networkEvent, sizeof(NETWORK_EVENT));
DeviceIoControl(
monitorDevice,
MONITOR_IOCTL_GET_EVENT,
0,
0,
&networkEvent,
sizeof(NETWORK_EVENT),
&dwBytesReturned,
NULL
);
- wfp driver receive ioctl code
MonitorEvtDeviceControl (
In WDFQUEUE Queue,
In WDFREQUEST Request,
In size_t OutputBufferLength,
In size_t InputBufferLength,
In ULONG IoControlCode
)
{
NTSTATUS status = STATUS_SUCCESS;
switch (IoControlCode)
{
case MONITOR_IOCTL_GET_EVENT:
{
DbgPrint(“Get IOCTL event: MONITOR_IOCTL_GET_EVENT from user-application \n”);
NTSTATUS rstatus;
NETWORK_EVENT pOutBuffer;
size_t bufSize;
rstatus = WdfRequestRetrieveOutputBuffer(Request, sizeof(NETWORK_EVENT), &pOutBuffer, &bufSize);
if (!NT_SUCCESS(rstatus))
{
DbgPrint(“Could not get request memory buffer status: %X\n”, rstatus);
status = STATUS_INVALID_PARAMETER;
break;
}
MonitorSendNetworEventToUserApp(pOutBuffer);
break;
}
default:
{
status = STATUS_INVALID_PARAMETER;
}
}
WdfRequestComplete(Request, status);
}
NTSTATUS MonitorSendNetworEventToUserApp(Inout NETWORK_EVENT networkEvent)
{
DbgPrint(“Enterd MonitorSendNetworEventToUserApp function\n”);
KLOCK_QUEUE_HANDLE lockHandle;
NTSTATUS status;
KeAcquireInStackQueuedSpinLock(&flowContextListLock, &lockHandle);
if (!IsListEmpty(&flowContextList))
{
FLOW_DATA* flowContext;
LIST_ENTRY* entry;
entry = RemoveHeadList(&flowContextList);
flowContext = CONTAINING_RECORD(entry, FLOW_DATA, listEntry);
networkEvent.inoutBound = flowContext->inoutBound;
networkEvent.ipProto = flowContext->ipProto;
networkEvent.localAddr = flowContext->localAddressV4;
networkEvent.localPort = flowContext->localPort;
networkEvent.remoteAddr = flowContext->remoteAddressV4;
networkEvent.remotePort = flowContext->remotePort;
networkEvent.processId = flowContext->processId;
RtlCopyBytes(networkEvent.procPath, flowContext->processPath, 1024);
networkEvent.time = flowContext->time;
RtlCopyMemory(pOutBuffer, pNetworkEvent, sizeof(NETWORK_EVENT));
}
else
{
DbgPrint(“list is empty!”);
}
KeReleaseInStackQueuedSpinLock(&lockHandle);
return STATUS_SUCCESS;
}
when i check value networkEvent structer values like this
DbgPrint(“%04d/%02d/%02d %2.2d:%2.2d:%2.2d Connection - proto: [%d] %lx:%d(L) <-> %lx:%d(R), pid:%i, procPath: %S\n”,
networkEvent.time.Year,
networkEvent.time.Month,
networkEvent.time.Day,
networkEvent.time.Hour,
networkEvent.time.Minute,
networkEvent.time.Second,
networkEvent.ipProto,
networkEvent.localAddr,
networkEvent.localPort,
networkEvent.remoteAddr,
networkEvent.remotePort,
networkEvent.processId,
networkEvent.procPath);
all value is fine. but, user-application dosen’t receive networkEvent values.
i think something miss, but i don’t know what should i do