Comments by Member 14130865 (Top 10 by date)

thank you @KarstenK but i just want to show my proof of concept to see if am doing right or worng.

now in my usermode i should do this , this is my read memory function.

Hide Copy Code
template <typename type="">
type RPM(ULONG ProcessId, UINT_PTR ReadAddress)
{
if (hDriver == INVALID_HANDLE_VALUE) {
return {};
}

DWORD64 Bytes;
Ke_Read_Request ReadRequest{};

type response{};

ReadRequest.ProcessId = ProcessId;
ReadRequest.Address = ReadAddress;
ReadRequest.Size = sizeof(type);
ReadRequest.Output = &response;
if(memcpy(pBuf,&ReadRequest,sizeof(ReadRequest))){
return response;
}else {
return 1;
}



and pBuf should be the one that i have opened with
Hide Copy Code
pBuf = MapViewOfFile(hMapFile, FILE_MAP_WRITE, 0, 0, 4096);


now if that would work because i haven't tested it yet but i just want to know if it will work or if am doing something wrong please correct me.

now kernel side :

Hide Copy Code
HANDLE g_hSection = NULL;
PVOID g_pSharedSection = NULL;

VOID ReadSharedMemory()
{
	if (!g_hSection)
		return;

	if (g_pSharedSection)
		ZwUnmapViewOfSection(NtCurrentProcess(), g_pSharedSection);

	SIZE_T ulViewSize = 1024 * 10;
	NTSTATUS ntStatus = ZwMapViewOfSection(g_hSection, NtCurrentProcess(), &g_pSharedSection, 0, ulViewSize, NULL, &ulViewSize, ViewShare, 0, PAGE_READWRITE | PAGE_NOCACHE);
	if (ntStatus != STATUS_SUCCESS)
	{
		DbgPrint("ZwMapViewOfSection fail! Status: %p\n", ntStatus);
		ZwClose(g_hSection);
		return;
	}
	DbgPrint("ZwMapViewOfSection completed!\n");

	DbgPrint("Shared memory read data: %s\n",g_pSharedSection);
}



now this can read that copied section from usermode but if all this would work how could i add the read function to IRP with this ? as its only reading it with
Hide   Copy Code
DbgPrint("Shared memory read data: %s\n",g_pSharedSection);


i want to add my functions to IRP after they have been copied from usermode something like this : snippet 

Hide   Copy Code
NTSTATUS KeReadRequest(PDEVICE_OBJECT pDriverObject, PIRP pIrp){
// do whatever here ...
}


then in
Hide   Copy Code
NTSTATUS OnMajorFunctionCall(PDEVICE_OBJECT pDriverObject, PIRP pIrp){

case IRP_MJ_READ:
KeReadRequest(pDriverObject, pIrp);
break;
}


i don't know if that will work or not but i will wait for your response btw i want to know how to copy that data or process that data from Usermode to my kernel side . to sum it up i want to pass that read struct from ReadSharedMemory function to
Hide   Copy Code
NTSTATUS KeReadRequest(PDEVICE_OBJECT pDriverObject, PIRP pIrp){
// do whatever here ...
}


because i need it there .

@CPallini thank you sir you made my day

thanks to you all guys i looked at that array and i used the normal for loop and it worked :)

@OriginalGriff thanks man +REP

@Rick York now org is (incomplete type is not allowed)