windows – 用户模式应用程序和内核模式驱动程序之间的双向交互

发布时间：2020-12-14 04:21:18 所属栏目：Windows 来源：网络整理

导读：我即将撰写以下互动： When there is a process about to start,driver will notify user app and then it will wait for response from the app. The app will decide whether or not to allow that process to be created normally or terminated immediat

我即将撰写以下互动：

When there is a process about to start,driver will notify user app and then it will wait for response from the app.

The app will decide whether or not to allow that process to be created normally or terminated immediately,and send
its decision back to the driver.

Base on the decision from user app. The driver will then allow or block the process execution.

我的问题是：从驱动程序通知用户模式应用程序然后让驱动程序等待响应的建议方法是什么？

对于事件通知,您可以使用通知事件.即内核调用IoCreateNotificationEvent和KeSetEvent.用户调用KeWaitForSingleObject.对于用户内核消息通信,您可以使用IOCTL.

或者,您可以只使用命名管道.

附：您不能将PsSetCreateProcessNotifyRoutine()用于您的目的,因为它仅用于审核,但不用于预防/取消.

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!