Using Overlapped I / O in DeviceIoControl

Using Overlapped I / O in DeviceIoControl


Various methods can be used, such as synchronizing with events and continuously receiving events through polling, to monitor the frequent events in the kernel driver one by one in user mode .

Scenario in question

Imagine that you continue to receive events with relatively simple polling. The kernel driver queues the event that occurred, and the user mode application issues the IOCTL to retrieve the contents of the queue. In this type of logic, the user-mode application will Whileexecute the same loop as DeviceIoControland will continue to communicate with the driver by calling.
while(true)
{
    BOOL ret =    DeviceIoControl(hDevice, IOCTL_RECV, &data, sizeof(DATA), 0,0,&dwReturn,NULL);
    if(ret)
    {
    // 처리..
    }
}

DeviceIoControl Blocking 발생

In the previously used logic, DeviceIoControlblocking occurs until an event occurs in the kernel driver . DeviceIoControlBlocking occurs in the user mode application DeviceIoControlis not returned. A problem occurs here, but the kernel driver is implemented to receive various IOCTLs, but requests for IOCTLs that receive events are not finished, so other DeviceIoControlcalls cannot be processed. The reason is that it can be processed one operation at a time due to the nature of File Object.
(https://community.osr.com/discussion/288276/can-a-deviceiocontrol-block)
Without FILE_FLAG_OVERLAPPED in the CreateFile call, regardless of how the driver is written, the operating system will only allow one outstanding I/O operation at a time on that file handle. It doesn't matter how many threads you have. All other calls will block until the first completes.`

The solution is FILE_FLAG_OVERLAPPEDoverlapped I / O

The prototype of CreateFile is as follows.
HANDLE CreateFileA(
  LPCSTR                lpFileName,
  DWORD                 dwDesiredAccess,
  DWORD                 dwShareMode,
  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
  DWORD                 dwCreationDisposition,
  DWORD                 dwFlagsAndAttributes,
  HANDLE                hTemplateFile
);
https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea As
I was learning Windows System programming, I talked about overlapping I / O when I learned about file handling. Overlapped I / O, which may not be used at any time, can be applied here. CreateFileOf dwFlagsAndAttributesthe FILE_FLAG_OVERLAPPEDsetting flags can be processed asynchronously Overlapped I / O when File I / O. Devices correspond to file objects, but device I / O can be treated as overlapped I / O.

Apply overlapped I / O

FILE_FLAG_OVERLAPPEDOpen the device using the flag as shown below .
HANDLE    m_hDevice = CreateFile(_T("\\\\.\\mydev"),
        GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, INVALID_HANDLE_VALUE);
Below is a part of the thread's Loop for receiving events.

//.....
HANDLE event;

OVERLAPPED overlapped;
event = CreateEvent(NULL, FALSE, FALSE, NULL);
memset(&overlapped, 0, sizeof(overlapped));
overlapped.hEvent = event;
while (pDlg->m_hDevice)
{


    DeviceIoControl(pDlg->m_hDevice, IOCTL_RECV, &ioctl, sizeof(MY_IOCTL), 0, 0, &dwReturn, &overlapped);

    DWORD iolen0;

    if (GetLastError() != ERROR_IO_PENDING ||
        !GetOverlappedResult(pDlg->m_hDevice, &overlapped, &iolen0, TRUE))
    {
        OutputDebugString(_T("DeviceIoControl fail."));
        continue;
    }
    dwReturn = iolen0;
        //처리...

    }
If OVERLAPPEDyou set the event in the structure and DeviceIoControlpass it to as above , DeviceIoControlis returned immediately upon invocation. It is returned before all requested IOCTLs are processed. Therefore GetOverlappedResult, it waits until the end of I / O by using a function. When the driver processes the event and completes, I / O is completed.
IOCTL can be processed by other threads while processing the event reception.

Comments

Post a Comment

Popular posts from this blog

Enabling Com Port on Hyper-V 2nd Generation VM / Windbg

Image
To test the UEFI boot environment, I created a second generation virtual machine in Hyper-V. And I had to configure the Com port to attach the kernel debugger.  However, the Com Port device was not visible in the 2nd generation Hyper-V VM.  Invisible Com port device Hyper-V 2nd generation VM must be assigned a pipe to the Com port to be visible in the device list. 1. VM termination First, shut down the VM before working. 2. Run as Powrshell administrator Detailed configuration of Hyper-V VM can be done through Powershell command.  Run Powershell with administrator privileges.  3. set-vmcomport  Run the following command to activate the com port. set -vmcomport -vmname [VM이름] -number [COM포트번호] [파이프이름] To check the COM port to which the pipe is assigned, execute the following command. get -vmcomport -vmname [VM이름] The following is an example of command execution.  https://docs.microsoft.com/en-us/powershell/module/hyper-v/set-vmcomport?view=win10-ps
Read more

DLL Injection using CreateRemoteThread in Windows 10

Image
DLL Injection using CreateRemoteThread One of the methods of DLL injection is to create a RemoteThread and load the desired DLL into the target process.  This is one of the simplest and most widely used methods.  CreateRemoteThread You can create a thread in another process using the API. CreateRemoteThread If you browse on MSDN, you'll see the following in Remarks: https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread   CreateRemoteThread function (processthreadsapi.h)-Win32 apps Creates a thread that runs in the virtual address space of another process. docs.microsoft.com Terminal Services isolates each terminal session by design.  Therefore,  CreateRemoteThread  fails if the target process is in a different session than the calling process. In translation, Terminal Services Pros say that if the target process is running in a different session, it will fail because the session is specified and executed
Read more