How to receive message from kernel in user-mode in c? - c

Question

Basically I want to get filepath of every file created in windows using File system minifilter driver on Post Operation and send the filepath to user-mode, I have achieved this using below code:
BOOLEAN
GetFullPath(
IN PFLT_FILE_NAME_INFORMATION nameInfo,
IN PFLT_CALLBACK_DATA FltCallBackData,
IN PCFLT_RELATED_OBJECTS FltObjects,
IN OUT PUNICODE_STRING pFullPathName){
UNREFERENCED_PARAMETER(nameInfo);
BOOLEAN bResult;
NTSTATUS status;
PDEVICE_OBJECT pDiskDeviceObject = NULL;
UNICODE_STRING VolumeName = { 0 };
PFLT_FILE_NAME_INFORMATION TempNameInfo = NULL;
PAGED_CODE();
__try{
VolumeName.Buffer = NULL;
// Get the associated file name
status = FltGetFileNameInformation(FltCallBackData, FLT_FILE_NAME_NORMALIZED
| FLT_FILE_NAME_QUERY_DEFAULT, &TempNameInfo);
if (!NT_SUCCESS(status)){
bResult = FALSE;
__leave;
}
status = FltParseFileNameInformation(TempNameInfo);
if (!NT_SUCCESS(status)){
bResult = FALSE;
__leave;
}
// Try to get the volume device object & convert this to the volume name
status = FltGetDiskDeviceObject(FltObjects->Volume, &pDiskDeviceObject);
if (!NT_SUCCESS(status)){
bResult = FALSE;
__leave;
}
// Get the volume name
status = IoVolumeDeviceToDosName(pDiskDeviceObject, &VolumeName);
if (!NT_SUCCESS(status)){
bResult = FALSE;
__leave;
}
// Store the filename in pFullPathName
RtlInitUnicodeString(pFullPathName, (PWSTR)NULL);
pFullPathName->MaximumLength = (USHORT)(VolumeName.Length +
TempNameInfo->Name.Length + sizeof(UNICODE_NULL));
//pFullPathName->Buffer = (PWSTR)ExAllocatePool2(PagedPool,
// pFullPathName->MaximumLength, AV_SCAN_CTX_TAG);
pFullPathName->Buffer = ExAllocatePool2(POOL_FLAG_PAGED, 100, '3331');
if (pFullPathName->Buffer == NULL){
AV_DBG_PRINTEX((0, AVDBG_TRACE_ZERO, "Failed to allocate memory\n"));
bResult = FALSE;
__leave;
}
status = RtlAppendUnicodeStringToString(pFullPathName, &VolumeName);
if (!NT_SUCCESS(status)){
ExFreePool(pFullPathName->Buffer);
bResult = FALSE;
__leave;
}
pFullPathName->MaximumLength = 100;
status = RtlAppendUnicodeStringToString(pFullPathName,
&TempNameInfo->ParentDir);
if (!NT_SUCCESS(status)){
bResult = FALSE;
__leave;
}
status = RtlAppendUnicodeStringToString(pFullPathName,
&TempNameInfo->FinalComponent);
if (!NT_SUCCESS(status)){
ExFreePool(pFullPathName->Buffer);
bResult = FALSE;
__leave;
}
//DbgPrint(" Full Path Name = %wZ\n", pFullPathName );
AV_DBG_PRINTEX((0, AVDBG_TRACE_ZERO, "<Fullpath> Full Path Name = %wZ, %d\n", pFullPathName, pFullPathName->Length));
LARGE_INTEGER timeout = { 0 };
timeout.QuadPart = 1;
//timeout.QuadPart = -(timeout.QuadPart * _1ms);
status = FltSendMessage(Globals.Filter,
&Globals.ScanClientPort,
pFullPathName,
pFullPathName->Length,
NULL,
NULL,
&timeout);
bResult = TRUE;
}
__finally{
// Free all allocated resources
if (pDiskDeviceObject)
ObDereferenceObject(pDiskDeviceObject);
if (VolumeName.Buffer)
ExFreePool(VolumeName.Buffer);
if (TempNameInfo)
FltReleaseFileNameInformation(TempNameInfo);
}
return bResult;
}
In my kernel debugger, I see the Full file path just as I want it, and then I basically receive that in user-mode as below:
int main() {
ULONG bytesReturned = 0;
AV_CONNECTION_CONTEXT connectionCtx = {0};
COMMAND_MESSAGE commandMessage = { 0 };
char* buffer = (char *)malloc(500);
HRESULT hResult = 0;
printf("Enter your request: ");
scanf_s("%s", buffer, max_buffer_length);
printf("Entered request is: %s:%d\n", buffer, strlen(buffer));
//strncpy_s(buffer,500, "status=sto", 11);
char recvbuffer[500] = { 0 };
if (port == NULL) {
connectionCtx.Type = AvConnectForScan;
hResult = FilterConnectCommunicationPort(L"\\NeehackAVScanPort", 0, &connectionCtx, sizeof(AV_CONNECTION_CONTEXT), NULL, &port);
printf("hresult: 0x%08x\n", hResult);
if (hResult) {
printf("Failed to Connect to Kernel\n");
return -1;
}
}
printf("Connected to kernel, sending: %s:%d\n", buffer, strlen(buffer));
/*
hr = FilterSendMessage( Context->ConnectionPort,
&commandMessage,
sizeof( COMMAND_MESSAGE ),
NULL,
0,
&bytesReturned);
*/
commandMessage.Command = AvCmdCreateSectionForDataScan;
hResult = FilterSendMessage(port, &commandMessage, sizeof(COMMAND_MESSAGE), recvbuffer, 500, &bytesReturned);
printf("sending data hresult: 0x%08x recv:%s\n", hResult, recvbuffer);
FILTER_MESSAGE_HEADER msg;
//connectionCtx.Type = AvConnectForScan;
while (true) {
hResult = FilterGetMessage(port,
&msg,
1024,
NULL);
printf("message is: %s:%wZ\n", msg, &msg);
}
if (FAILED(hResult)) {
printf("Failed to send data 0x%08x\n", hResult);
return -1;
}
printf("kernel said: %s\n", recvbuffer);
return 0;
}
The problem is on printf("message is: %s:%wZ\n", msg, &msg); I get null strings or message is: :(null) every time the message is sent by the kernel.
Can anyone tell me what am I doing wrong?

Answer 1

You need to have both ends of the port agree on the format of the message. Something along the lines of the following just to give an idea:
typedef struct _MY_MESSAGE {
FILTER_MESSAGE_HEADER Header;
WCHAR FullPathName[1024];
} MY_MESSAGE;
FltSendMessage(pFullPathName->Buffer, pFullPathName->Length)
MY_MESSAGE Message;
FilterGetMessage(&Message.Header, sizeof(Message));
printf("FullPathName: %ls\n", Message.FullPathName);