Two-way interaction between user-mode app and kernel-mode driver?

8
votes

I'm about to write the following interaction:

  • When there is a process about to start, driver will notify user app and then it will wait for response from the app.

  • The app will decide whether or not to allow that process to be created normally or terminated immediately, and send its decision back to the driver.

  • Base on the decision from user app. The driver will then allow or block the process execution.

My question is: What is recommended way to notify user-mode app from driver and then make the driver wait for the response?

1
windowsprocesskerneldriver
Please do not put tags in the question title. Other than that, very good question. - Scott Chamberlain
What method are you using to detect processes that are about to start? - Harry Johnston
-Scott Chamberlain: Sorry for that. -Harry Johnston: I use psSetCreateProcessNotifyRoutineEx to detect the new process creation. And then I use its callback PCREATE_PROCESS_NOTIFY_ROUTINE_EX to do something with that new process. - Joseph Do
I think IOCTL would be best in this situation, in both directions. The user-mode component would be a bit trickier if decisions for multiple processes must be made in parallel rather than one at a time, but not unreasonably so. The only doubt in my mind is whether it is legitimate to block in CreateProcessNotifyEx, but since it runs in the context of the thread which created the new process I guess it should be OK. - Harry Johnston

1 Answers

6
votes

For event notification, you can use a notification event. I.e. the kernel calls IoCreateNotificationEvent and KeSetEvent. The user calls KeWaitForSingleObject. For user-kernel message communication, you can use IOCTL.

Alternatively, you can just use a named pipe for both purpose.

P.S. You can't use PsSetCreateProcessNotifyRoutine() for your purpose because it's only for auditing, but not for prevention/cancellation.