ASM Community

hi all, i'm going to make a kernel driver, that hooking into System Service Table, it's will hook NtCreateFile and NtOpenFile to keep track which file is accessed, then send this information to a program on usermode to check that if it's enough permission(that i define) to access the file, this program send back to kernel driver that allow or deny signal. The problem is in multiple threads running, i have not any idea to handing, like this
thread1-openfile --> my hook function --> wait for usermode
thread2-openfile --> my hook function --> wait for usermode

i don't know which allow/deny signal apply to which thread .
hum! any idea ? thanks very much.

yeh, let's say that i have two thread, thread1 belong to process1, thread2 belong to process2, And a process X-which keep track all the EVENTs.
thread1 call NtOpenFile --> my hook function send signal to process X by raise an event and WaitForObject(objectname="myevent")
thread2 call NtOpenFile --> my hook function send signal to process X by raise an event and WaitForObject (objectname="myevent")
then after process-X do something and return deny code to the call of thread2, it signal thread2 to continue, but if i raise the event, maybe both of thread will resume to run, but thread1 will not to know it's should allow or deny the open file request.
may i was wrong in approach this problem?

Ugh, the code in that article is horrible.

    a=str.Length;buff=str.Buffer;
    while(1)
    {
        if(buff=='.'){a++;break;}
        a--;
    }

Now, whaaaat happens if a user tries to execute "x:\path\to\evil\file" - with no extension? Perfectly legal under win32.

    //if it is not executable, it does not make sense to be bothered about it

    //return 1

    if(_stricmp(&buff,"exe")){RtlFreeAnsiString(&str);return 1;}

.com, .scr, .pif, no-extension, etc?

    strcpy(&output[8],buff);

Ugh, strcpy? In kernel mode?

Oh, and a nasty spinloop is used to synchronize with the client... not to mention that memmove with a 4-byte value is used instead of some DWORD casting and atomic intrinsics. That person shouldn't be writing kernel-mode code.

other away, i think:
kernel-mode

KeWaitForMutexObject(enter_wait_object);

// ... Fill filename to output buffer then 

KeSetEvent(usermode_should_read_buffer_now);           //  --> User-mode check for permission

KeWaitForEvent(usermode_finished);

// ... Read user return value from system buffer.

KeReleaseMutex(enter_wait_object);

usermode

while(true){
       WaitForSingleObject(usermode_should_read_buffer_now);
       ReadFile(....);
       //process data and return value in kernel system buffer.
       WriteFile(...);
       SetEvent(usermode_finished);
}

is it better?