![]() |
|
#1
|
|||
|
|||
|
How to pass the large data in kernel mode to user mode?
Hi
I need to pass the large data in kernel mode to user mode. So, i created a file from kernel mode and write request data to new file. Do you can show other method for me, please?.Thanz u to help me. This is my source in kernel mode: Code:
Status = ZwQuerySystemInformation(
_SystemProcessesAndThreadsInformation, pBuffer,0, &cb_x);
_snprintf(buffer,255,"ROOTKIT: Get var cb_x 1: %4X \n",cb_x);
DbgPrint(buffer);
if (cb_x!=0)
{
pBuffer = ExAllocatePool (NonPagedPool, cb_x);
if (pBuffer == NULL) // if memory allocation failed, exit
{
DbgPrint("ROOTKIT: ExAllocatePool failed");
}
else
{
DbgPrint("ROOTKIT: ExAllocatePool OK");
Status = ZwQuerySystemInformation(
_SystemProcessesAndThreadsInformation, pBuffer, cb_x, &cb_x);
_snprintf(buffer,255,"ROOTKIT: Get var cb_x 2: %4X \n",cb_x);
DbgPrint(buffer);
};
RtlInitUnicodeString(&g_usFileName,FILE_NAME_TXT);
InitializeObjectAttributes(&oa, &g_usFileName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
Status_f=ZwCreateFile(&hFile,FILE_WRITE_DATA|SYNCHRONIZE,&oa,&iosb, 0, FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,FILE_OPEN|FILE_CREATE, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
if (Status_f == STATUS_SUCCESS)
{
DbgPrint("ROOTKIT: File created\n");
Status_f=ZwWriteFile(hFile, 0, NULL, NULL,&iosb,
pBuffer,cb_x, NULL, NULL);
ZwClose(hFile);
}
else
{
_snprintf(buffer,255,"ROOTKIT: Can't create file. Status: %08X\n",(ULONG)Status_f );
DbgPrint(buffer);
};
ExFreePool(pBuffer); // free the memory associated with the buffer
};
Last edited by benina; 02-22-2010 at 23:50. |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Hades:Windows kernel driver lets reverse engineers monitor user and kernel mode code | sh3dow | Source Code | 0 | 05-12-2016 03:15 |
| Use IDA in kernel mode ?? | Veyskarami | General Discussion | 14 | 02-23-2013 12:38 |
| Kernel-Mode GUI!? (like SoftIce) | Cobi | General Discussion | 1 | 01-21-2005 02:24 |
| Kernel Mode Driver for NT | SPeY | General Discussion | 12 | 04-22-2004 15:34 |