HyperDbg Debugger
Loading...
Searching...
No Matches
Ioctl.c File Reference

IOCTL Functions form user mode and other parts. More...

#include "pch.h"

Functions

NTSTATUS DrvDispatchIoControl (PDEVICE_OBJECT DeviceObject, PIRP Irp)
 Driver IOCTL Dispatcher.
 

Detailed Description

IOCTL Functions form user mode and other parts.

Author
Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)
Version
0.1
Date
2020-06-01

Function Documentation

◆ DrvDispatchIoControl()

NTSTATUS DrvDispatchIoControl ( PDEVICE_OBJECT DeviceObject,
PIRP Irp )

Driver IOCTL Dispatcher.

Parameters
DeviceObject
Irp
Returns
NTSTATUS
24{
25 PIO_STACK_LOCATION IrpStack;
26 PREGISTER_NOTIFY_BUFFER RegisterEventRequest;
27 NTSTATUS Status;
28
29 //
30 // Here's the best place to see if there is any allocation pending
31 // to be allcated as we're in PASSIVE_LEVEL
32 //
33 // DO NOT CHANGE CALLING OF THE FOLLOWING FUNCTION
34 //
36
38 {
39 IrpStack = IoGetCurrentIrpStackLocation(Irp);
40
41 switch (IrpStack->Parameters.DeviceIoControl.IoControlCode)
42 {
44
45 //
46 // First validate the parameters.
47 //
48 if (IrpStack->Parameters.DeviceIoControl.InputBufferLength < SIZEOF_REGISTER_EVENT || Irp->AssociatedIrp.SystemBuffer == NULL)
49 {
50 Status = STATUS_INVALID_PARAMETER;
51 LogError("Err, invalid parameter to IOCTL dispatcher");
52 break;
53 }
54
55 //
56 // IRPs supply a pointer to a buffer at Irp->AssociatedIrp.SystemBuffer.
57 // This buffer represents both the input buffer and the output buffer that
58 // are specified in calls to DeviceIoControl
59 //
60 RegisterEventRequest = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
61
62 switch (RegisterEventRequest->Type)
63 {
64 case IRP_BASED:
65
66 LogRegisterIrpBasedNotification((PVOID)Irp, &Status);
67
68 break;
69 case EVENT_BASED:
70
72 {
73 Status = STATUS_SUCCESS;
74 }
75 else
76 {
77 Status = STATUS_UNSUCCESSFUL;
78 }
79
80 break;
81 default:
82 LogError("Err, unknown notification type from user-mode");
83 Status = STATUS_INVALID_PARAMETER;
84 break;
85 }
86 break;
87
88 default:
89 LogError("Err, unknown IOCTL");
90 Status = STATUS_NOT_IMPLEMENTED;
91 break;
92 }
93 }
94 else
95 {
96 //
97 // We're no longer serve IOCTL
98 //
99 Status = STATUS_SUCCESS;
100 }
101
102 if (Status != STATUS_PENDING)
103 {
104 Irp->IoStatus.Status = Status;
105
106 IoCompleteRequest(Irp, IO_NO_INCREMENT);
107 }
108
109 return Status;
110}
struct _REGISTER_NOTIFY_BUFFER * PREGISTER_NOTIFY_BUFFER
@ EVENT_BASED
Definition DataTypes.h:256
@ IRP_BASED
Definition DataTypes.h:255
#define LogError(format,...)
Log in the case of error.
Definition HyperDbgHyperLogIntrinsics.h:113
#define IOCTL_REGISTER_EVENT
ioctl, register a new event
Definition Ioctls.h:64
BOOLEAN LogRegisterEventBasedNotification(PVOID TargetIrp)
Create an event-based usermode notifying mechanism.
Definition Logging.c:1583
BOOLEAN LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG *Status)
Register a new IRP Pending thread which listens for new buffers.
Definition Logging.c:1464
BOOLEAN PoolManagerCheckAndPerformAllocationAndDeallocation()
This function performs allocations from VMX non-root based on g_RequestNewAllocation.
Definition PoolManager.c:302
#define STATUS_UNSUCCESSFUL
Definition Windows.h:172
BOOLEAN g_AllowIOCTLFromUsermode
Determines whether the clients are allowed to send IOCTL to the drive or not.
Definition Global.h:42
#define SIZEOF_REGISTER_EVENT
Definition Events.h:429
Used to register event for transferring buffer between user-to-kernel.
Definition DataTypes.h:279
NOTIFY_TYPE Type
Definition DataTypes.h:280