阅读:2256回复:1
内核态KeSetEvent完用户态没反应
在用户态创建完事件然后传到驱动里,然后创建一个线程来等待内核态的返回
hUserWaitEvent=CreateEvent(NULL,TRUE,FALSE,NULL); hUserSetEvent=CreateEvent(NULL,TRUE,FALSE,NULL); if ((hUserWaitEvent==INVALID_HANDLE_VALUE) || (hUserSetEvent==INVALID_HANDLE_VALUE)) { //printf("CreateEvent failed, exit.\n"); //KernelDriver.UnDoCDriver(); UnloadDriver(hDriver); return 0; } EvntInfo.hUserWaitEvent=hUserWaitEvent; EvntInfo.hUserSetEvent=hUserSetEvent; DeviceIoControl(hDriver,IOCTL_SAVE_EVENT,&EvntInfo,sizeof(EvntInfo),NULL,0,&bret,NULL); ResetEvent(hUserWaitEvent); ResetEvent(hUserSetEvent); hThread=CreateThread(NULL,512,ThreadProc,NULL,NULL,&ThreadId); 线程函数: ULONG WINAPI ThreadProc(PVOID Context) { REGISTRY_INFORMATION RegInfo; CHAR CreateAllowed=TRUE; DWORD bret; CHAR szBuf[256]; // MessageBox(NULL,"success","tips",MB_OK); for (;;) { WaitForSingleObject(hUserWaitEvent,INFINITE);//内核态已经置位,但是没反应 DeviceIoControl(hDriver,IOCTL_REGISTRY_INFO,NULL,0,&RegInfo,sizeof(RegInfo),&bret,NULL); sprintf(szBuf,"进程[%d] Tried to modify key [%s] .\n 允许吗?",RegInfo.ProcessId,RegInfo.KeyPath); if(IDOK==MessageBox(NULL,szBuf,"tips",MB_OKCANCEL)) CreateAllowed=true; else CreateAllowed=false; //if (!CreateAllowed) printf("Intercepetted create operation.\n"); DeviceIoControl(hDriver,IOCTL_ALLOW_MODIFY,&CreateAllowed,sizeof(CreateAllowed),NULL,0,&bret,NULL); SetEvent(hUserSetEvent); ResetEvent(hUserWaitEvent); } } 内核态接受并保存事件: case IOCTL_SAVE_EVENT://把事件传到驱动 { EVENT_INFORMATION EvntInfo; __try { ProbeForRead( InputBuffer, sizeof(EvntInfo), sizeof( ULONG ) ); memcpy(&EvntInfo,InputBuffer,8); } __except(EXCEPTION_EXECUTE_HANDLER) { ; } if (!NT_SUCCESS(ObReferenceObjectByHandle(EvntInfo.hKernelSetEvent,0,*ExEventObjectType,UserMode,&EventKernelSet,NULL))) { EventKernelSet=NULL; } if (!NT_SUCCESS(ObReferenceObjectByHandle(EvntInfo.hKernelWaitEvent,0,*ExEventObjectType,UserMode,&EventKernelWait,NULL))) { EventKernelWait=NULL; } DbgPrint("[Kernel_Driver] EventKernelSet = 0x%X, EventKernelWait=0x%X.\n",EventKernelSet,EventKernelWait); s = STATUS_SUCCESS; break; } 使用户态的WaitForSingleObject置位 NTSTATUS WaitForUserAnswer() { if (EventKernelWait && EventKernelSet) { if (CreateIsProgressing) return STATUS_ACCESS_DENIED; // 防止混乱 CreateIsProgressing=TRUE; KeSetEvent(EventKernelWait,0,TRUE);//KeSetEvent不成功,用户态的函数没反应 KeWaitForSingleObject(EventKernelSet,Executive,KernelMode,FALSE,NULL); KeResetEvent(EventKernelWait); CreateIsProgressing=FALSE; return (CreateAllowed?STATUS_SUCCESS:STATUS_ACCESS_DENIED); } return STATUS_SUCCESS; } 不清楚为什么内核态已经置位了但是用户态没反应? |
|
沙发#
发布于:2010-05-31 20:44
自己解决了!!太不小心了!!哎!
|
|