0

Currently i am developing windows driver which can protect user password, i want to display one message to the user when the user activate the protection, indicating the driver has started working. But this message can't be accessed by the user space, in case that malicious software can fake this message while in fact the driver didn't work at all. And this message is defined by the user, so i can't write it in the driver. I have searched the internet for the answer, but failed. I have tried to using bcdedit.exe to edit start-up parameters, but i dont know how can i get this message in the driver. Anyone has good ideas? As long as user space applications can't access the message and this message is from the user. Thanks!

2
  • Is your driver actually a filter? Keep in mind that if the computer is compromised, the bad guy can simply remove your driver and replace it with visual basic mock up of whatever "secured" message you want to display
    – ixe013
    Mar 7, 2012 at 11:41
  • yep, my driver is a keyboard filter, my assumption is that the kernel is trusted and the user space is not trusted. The message can't be known to the applications, so it doesnt know which message to display
    – yorath
    Mar 7, 2012 at 13:05

1 Answer 1

0

(Here is an answer, but read the footnote about the threat model)

  1. In your filter, call FltCreateCommunicationPort. The PFLT_MESSAGE_NOTIFY MessageNotifyCallback parameter is a pointer to a messaging callback function.
  2. Your client will call FilterSendMessage to send the message to the driver
  3. In your driver's callback function (the MessageNotifyCallback), store the message chosen by the user. Beware of memory alignement.
  4. When needed, your client calls FilterSendMessage again, this time to retreive the string it sent to the driver.
  5. Call FltCloseCommunicationPort and other cleanup functions.

Type findstr /s FltCreateCommuncationPort *.c in the src directory of your WDK installation. Find any Microsoft filter sample to try your idea, it will get you up and running quickly. Copy the working code to your filter when done.

But do think about your thread model. Either I don't understand something (quite possible ;) or that this is not worth the effort. Why not check if your driver is installed, running and that the digital signature is valid ?

Maybe you can update your OP by telling us how will the user mode code know that it is sending the string (message to display) to the legitimate driver in the first place ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.