我正在开发内核模式过滤器驱动程序,我希望该驱动程序将UNICODE 字符串发送到在用户模式下运行的 exe。请为此提供一个示例,因为我是驱动程序开发的初学者。
下面是我的驱动程序的代码(我想从哪里发送 UNICODE 字符串)
#include "drv_common.h"
#include "ntddk.h"
#include "FsFilter.h"
#define SOME_SIZE
// PassThrough IRP Handler
NTSTATUS FsFilterDispatchPassThrough( __in PDEVICE_OBJECT DeviceObject, __in PIRP Irp )
{
PFSFILTER_DEVICE_EXTENSION pDevExt = (PFSFILTER_DEVICE_EXTENSION)DeviceObject->DeviceExtension;
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(pDevExt->AttachedToDeviceObject, Irp);
}
///////////////////////// struct file info ////////////////////////////////////
struct {
OBJECT_NAME_INFORMATION NameInfo;
WCHAR Buffer[64]; // 64 chars must be enough for everybody :)
} InfoBuffer;
///////////////////////////////////////////////////////////////////////////////////////////////////
// IRP_MJ_CREATE IRP Handler
NTSTATUS FsFilterDispatchCreate(
__in PDEVICE_OBJECT DeviceObject,
__in PIRP Irp
)
{
PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;
PUNICODE_STRING **temp**;
RtlInitUnicodeString( temp, L"\\vs\\vs\\Setup\\eula.txt" );
LONG flag = RtlCompareUnicodeString( temp, &pFileObject->FileName, TRUE );
if ( flag == 0 )
{
DbgPrint("File is opened.\n" );
return STATUS_UNSUCCESSFUL;
}
return FsFilterDispatchPassThrough(DeviceObject, Irp);
}
我想将&pFileObject->FileName (UNICODE String) 从上述代码发送到用户模式下的可执行文件。假设,该可执行文件只会在控制台上打印此字符串。下面是我在用户模式下的 exe 代码
.......
.......
int main()
{
cout<< getUnicodeStringFromKernel(); // Just supposition
return 0;
}