Kernel Mode Driver and IOCTL - windows

Question

What I'm trying to do:
User-mode app sends Process ID to driver
Driver gets handle to specified Process ID
Drivers passes opened handle to user-mode app
I'm not sure if this code is even completely working. I'm quite new to drivers, so I haven't set up debugging yet and virtual machine hasn't finished downloading (slow connection problems).
Getting Process ID from user-mode app should be working fine and it should be getting stored in PROCESS_INFO struct as ProcessId. The opened handle is stored in the same struct as ProcessHandle to be sent back to the user-mode application. I'm not sure how to return data from kernel to user-mode tho, maybe someone could explain briefly.
Here's my code:
#include <ntifs.h>
#include <wdf.h>
DRIVER_INITIALIZE DriverEntry;
UNICODE_STRING DeviceName = RTL_CONSTANT_STRING(L"\\Device\\GetSysHandle"), SymbolicLink = RTL_CONSTANT_STRING(L"\\DosDevices\\GetSysHandle");
typedef struct _PROCESS_INFO
{
HANDLE ProcessId;
HANDLE ProcessHandle;
}PROCESS_INFO, *PPROCESS_INFO;
BOOLEAN GetSysHandle(PPROCESS_INFO ProcessInfo)
{
NTSTATUS status = STATUS_ACCESS_DENIED;
PEPROCESS eProcess = NULL;
status = PsLookupProcessByProcessId(ProcessInfo->ProcessId, &eProcess);
if ((!NT_SUCCESS(status)) || (!eProcess))
{
return FALSE;
}
status = ObOpenObjectByPointer(eProcess, 0, NULL, 0, 0, KernelMode, &ProcessInfo->ProcessHandle);
if ((!NT_SUCCESS(status)) || (!ProcessInfo->ProcessHandle))
{
ObDereferenceObject(eProcess);
return FALSE;
}
return TRUE;
}
void Unload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("# GetSysHandle driver unloaded.");
IoDeleteSymbolicLink(&SymbolicLink);
IoDeleteDevice(pDriverObject->DeviceObject);
}
NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP irp)
{
PIO_STACK_LOCATION io;
PPROCESS_INFO ProcessInfo;
NTSTATUS status;
io = IoGetCurrentIrpStackLocation(irp);
irp->IoStatus.Information = 0;
switch (io->MajorFunction)
{
case IRP_MJ_CREATE:
status = STATUS_SUCCESS;
break;
case IRP_MJ_CLOSE:
status = STATUS_SUCCESS;
break;
case IRP_MJ_READ:
status = STATUS_SUCCESS;
break;
case IRP_MJ_WRITE:
ProcessInfo = (PPROCESS_INFO)MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
if (!ProcessInfo)
{
status = STATUS_INSUFFICIENT_RESOURCES;
break;
}
if (!GetSysHandle(ProcessInfo))
{
DbgPrint("# Failed to get process handle");
status = STATUS_UNSUCCESSFUL;
break;
}
status = STATUS_SUCCESS;
irp->IoStatus.Information = sizeof(PROCESS_INFO);
break;
default:
status = STATUS_INVALID_DEVICE_REQUEST;
break;
}
irp->IoStatus.Status = status;
IoCompleteRequest(irp, IO_NO_INCREMENT);
return status;
}
NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
{
PDEVICE_OBJECT DeviceObject;
ULONG i;
DbgPrint("# GetSysHandle driver loaded");
IoCreateDevice(DriverObject, 0, &DeviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &DeviceObject);
IoCreateSymbolicLink(&SymbolicLink, &DeviceName);
for (i = 0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)
{
DriverObject->MajorFunction[i] = DriverDispatch;
}
return STATUS_SUCCESS;
}

Answer 1

First and foremost (to avoid confusion): this code is for Windows and Windows Drivers.
The biggest issue I see with your driver code is that you aren't registering the IRP major functions inside of DriverEntry. You will need to set the MajorFunction parameters of the PDRIVER_OBJECT DriverObject to the dispatch functions. Without assigning these MajorFunctions, the driver will have no way of knowing what function to call when receiving a command.
To do this, break up the cases for the switch (io->MajorFunction) into different dispatch functions. For example, IRP_MJ_WRITE will be its own function, and you can declare it like so:
DRIVER_DISPATCH DispatchReadFunction;
In this case, we will want all read commands issued to the driver to run whatever code is inside the DispatchReadFunction function. So the definition will look a little like this:
NTSTATUS DispatchReadFunction(_In_ PDEVICE_OBJECT DriverObject, _In_ PIRP Irp)
{
NTSTATUS status = STATUS_SUCCESS;
//Do read code here
return status;
}
Once we have the DispatchReadFunction function written, you will need to assign it to the DriverObject->MajorFunction in the DriverEntry function like so:
DriverObject->MajorFunction[IRP_MJ_READ] = DispatchReadFunction;
Finally, stub out and write the rest of the IRP_MJ_ functions that you need, making sure that you assign them to the MajorFunction memeber of DriverObject.
My DriverEntry function looks like this (I removed extra functionality):
NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
{
NTSTATUS status;
status = STATUS_SUCCESS;
DriverObject->MajorFunction[IRP_MJ_READ] = DispatchReadFunc;
DriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreateFunc;
DriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchCloseFunc;
DriverObject->MajorFunction[IRP_MJ_WRITE] = DispatchWriteFunc;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDevCtrlFunc;
return status;
}
A good starting point would be here. This link also includes a simple example (driver code and application code) that does what you are attempting to do.
Good Luck!