1

I am trying to convert PVOID to ULONG but it always fails and gives me wrong data and it is also adviced that not to type cast pointer variables to int, ulong or such other data types in msdn like ULONG client = (ULONG) pvoidVar but i tried different techniques and pre defined functions like:

ULONG client = PtrToUlong(pvoidVar);
ULONG client = (ULONG) PtrToUlong(pvoidVar);

What is happening is that i am trying to send client id from a usermode app to kernel driver but the recieving part in kernel driver makes it as PVOID Irp->UserBuffer also it sends process id which i want to use as a HANDLE now now handles are same as PVOID and i thought of using it directly but it still doesn't work like:

HANDLE processID = (HANDLE) Irp->UserBuffer;
HANDLE processID = Irp->UserBUffer;

I have read everywhere and all have adviced to use PtrToUlong and HANDLE is same as PVOID am i wrong? please advice me how to convert PVOID to ULONG or how can i use PVOID as a HANDLE

EDIT---

here is the code for my main driver it doesn't crash but gives me wrong output

#include <ntddk.h>
#include <wdm.h>

#define DEVICE L"\\Device\\TEST"
#define DOSDEVICE L"\\DosDevices\\TEST"

VOID Unload(PDRIVER_OBJECT  DriverObject) {
    UNICODE_STRING DosDeviceName;

    DbgPrint("Driver Unloaded");

    RtlInitUnicodeString(&DosDeviceName, DOSDEVICE);
    IoDeleteSymbolicLink(&DosDeviceName);

    IoDeleteDevice(DriverObject->DeviceObject);
}

NTSTATUS IODispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

NTSTATUS IOManager(PDEVICE_OBJECT DeviceObject, PIRP Irp) {

    PIO_STACK_LOCATION StackLocation = IoGetCurrentIrpStackLocation(Irp);
    ULONG IRPcode = StackLocation->Parameters.DeviceIoControl.IoControlCode;

            // Here i cannot convert pvoid as ULONG if i try to do that it gives me some other value
    DbgPrint("%lu", (ULONG)Irp->AssociatedIrp.SystemBuffer);


    NTSTATUS ntStatus = STATUS_SUCCESS;
    HANDLE hProcess;
    OBJECT_ATTRIBUTES ObjectAttributes;
    CLIENT_ID ClientId;

            // Here i cannot use pvoid directly as a handle nor cast it as a handle as it fails
    ClientId.UniqueProcess = (HANDLE)Irp->AssociatedIrp.SystemBuffer;
    ClientId.UniqueThread = NULL;

    InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_INHERIT, NULL, NULL);

    ntStatus = ZwOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &ClientId);
    if(NT_SUCCESS(ntStatus)) {
        ZwClose(hProcess);
    }

    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath) {
    NTSTATUS status = STATUS_SUCCESS;
    int uiIndex = 0;
    PDEVICE_OBJECT pDeviceObject = NULL;
    UNICODE_STRING DriverName, DosDeviceName;

    DbgPrint("Driver Loaded");

    RtlInitUnicodeString(&DriverName, DEVICE);
    RtlInitUnicodeString(&DosDeviceName, DOSDEVICE);

    pDriverObject->DriverUnload =  Unload;

    status = IoCreateDevice(pDriverObject, 0, &DriverName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDeviceObject);

    if (!NT_SUCCESS(status)) {
        DbgPrint("IoCreateDevice failed: %x", status);
        return status;
    }

    status = IoCreateSymbolicLink(&DosDeviceName, &DriverName);

    if (!NT_SUCCESS(status)) {
        IoDeleteDevice(pDeviceObject);
        DbgPrint("IoCreateSymbolicLink failed");
        return status;
    }

    pDriverObject->MajorFunction[IRP_MJ_CREATE] = IODispatch;
    pDriverObject->MajorFunction[IRP_MJ_CLOSE]  = IODispatch;
    pDriverObject->MajorFunction[IRP_MJ_READ]   = IODispatch;
    pDriverObject->MajorFunction[IRP_MJ_WRITE]  = IODispatch;
    pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IOManager;

    return status;

}

here is my user mode app

#define SYSFILE L"C:\\TEST.sys"
#define SERVICENAME L"TEST"

BOOL GetProcessList();
VOID startServ(DWORD processID);

int _cdecl main(void) {
    GetProcessList();
    return 0;
}

BOOL GetProcessList() {
    HANDLE hProcessSnap;
    PROCESSENTRY32 pe32;

    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE) {
        printf("CreateTool");
        getchar();
        return(FALSE);
    }

    pe32.dwSize = sizeof(PROCESSENTRY32);

    if(!Process32First(hProcessSnap, &pe32)) {
        CloseHandle(hProcessSnap);
        printf("Process32");
        getchar();
        return(FALSE);
    }

    do {
        if (wcscmp(L"test.exe", pe32.szExeFile) == 0) {
            startServ(pe32.th32ProcessID);
        }

    } while(Process32Next(hProcessSnap, &pe32));

    CloseHandle(hProcessSnap);
    return(TRUE);
}

VOID startServ(DWORD processID) {

    SC_HANDLE hSCManager;
    SC_HANDLE hService;
    SERVICE_STATUS ss;

    hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE);

    printf("Load Driver\n");

    if(hSCManager)
    {
        printf("Create Service\n");

        hService = CreateService(hSCManager, SERVICENAME, 
            SERVICENAME, 
            SERVICE_ALL_ACCESS, 
            SERVICE_KERNEL_DRIVER,
            SERVICE_DEMAND_START, 
            SERVICE_ERROR_IGNORE, 
            SYS_FILE, 
            NULL, NULL, NULL, NULL, NULL);

        printf("CreateService: %d\r\n", GetLastError());

        if(!hService) {
            hService = OpenService(hSCManager, SERVICENAME, SERVICE_ALL_ACCESS);
        }

        printf("OpenService: %d\r\n", GetLastError());

        if(hService) {
            printf("Start Service\n");

            StartService(hService, 0, NULL);

            printf("StartService: %d\r\n", GetLastError());

            HANDLE hFile;

            hFile = CreateFile(L"\\\\.\\Global\\TEST\0", GENERIC_READ|GENERIC_WRITE, 0, NULL,
                OPEN_EXISTING, 0, NULL);

            printf("CreateFile: %d\r\n", GetLastError());

            wchar_t pid[1024];

            wsprintf(pid, L"%d", processID);

            if(hFile) {
                char ret[1024];
                DWORD bytes;

                DeviceIoControl(hFile, 4092, pid, (wcslen(pid)+1)*2, &ret, sizeof(ret), &bytes, NULL); 
                CloseHandle(hFile);
            }

            printf("Press Enter to close service\r\n");
            getchar();
            ControlService(hService, SERVICE_CONTROL_STOP, &ss);

            DeleteService(hService);

            CloseServiceHandle(hService);

        }

        CloseServiceHandle(hSCManager);
    }

}

Now all this doesn't crash or break or give me blue screen but it gives me the wrong output in the driver how ever if i do not cast it and use it as PVOID only then it gives me the correct output

4
  • Is this 32-bit or 64-bit? Nov 28, 2013 at 12:22
  • @RogerRowland: 32 bit but i will make for 64 also Nov 28, 2013 at 12:23
  • What do you mean "doesn't work"? Doesn't compile? Crashes? Turns the computer into a flying cabbage? What do you mean by "process id which i want to use as a handle", what is the point? Nov 28, 2013 at 21:12
  • i have added the full source please review it Nov 29, 2013 at 10:39

3 Answers 3

1

You have missed a pointer dereference:

HANDLE processID = *(HANDLE*)Irp->UserBuffer;

Also pay attention that sizeof(HANDLE) depends on a process bitness, so it is better to use fixed size types. For PID/TID values 32-bit is enough.

Update:

Also you are passing a string representation of the PID. Use a binary form:

DeviceIoControl(hFile, 4092, &processID, sizeof(processID)
2
  • Please, show us more your code: how your IOCTL is defined and how do you send it. Nov 29, 2013 at 7:02
  • I have added the full source of both driver and user mode app please review it thanks Nov 29, 2013 at 10:40
0

You say you're trying to send a "client id" from user to kernel space. What is this entity "client id"? I am not familiar with this term.

  • If it is a pointer, then it is meaningful in (at maximum) one of either user space or kernel space, so it makes no sense to pass it from one to the other; these are separate address spaces.
  • If it is a ULONG, then you don't need to do type conversions, so your question is wrong.
  • If you think it is both a pointer and a ulong, then you are probably confused, as these are different types.

What do process IDs have to do with this problem? They are a fourth type of entity, neither your 'client id's nor pointers nor ulongs.

I'm sorry I can't help more; I can't understand what you are trying to do.

I have to say, it scares me greatly that you are attempting to write Win32 kernel-mode code, but seem very confused. Perhaps you should explain why you think you need to write kernel-mode code. You should probably start at the very beginning: "I am trying to make a software system that achieves..."

6
  • I am trying to make a license system plus learn windows driver development clientID is a id generated by my server the user mode app will fetch it and send it to the driver it will verify it now if the license is expired then the driver will terminate the app and will not allow it to start (this is why i need process id) now i use only WriteFile api to communicate with the driver as there is yet much to learn so the data received from the user app is in pvoid as i use PIRP and the data is in UserBuffer of PIRP object which is a PVOID sorry if i am still confusing you. Nov 28, 2013 at 12:36
  • If your client ID is an opaque number, you don't need to convert it to or from a pointer. If you're using an I/O Request Packet to pass data across the user/kernel space boundary, then you probably want to put this client ID in the packet. Nov 28, 2013 at 13:22
  • Also, you can't trust the kernel; it may have a rootkit, or a crack for your license system, loaded, as well as your license system. Or something may be snooping the exchange. How do you intend to defend against replay attacks? Nov 28, 2013 at 13:24
  • If I were you, I would investigate the mode of operation of existing licensing systems, for example FlexLM. None of them that I'm aware of have kernel-mode components. You might like to hand out cryptographically signed tokens a la Kerberos from a user-mode licensing server to the license-encumbered clients. I hate the entire idea of software licensing on principle (I use open source), so this is it from me. Good luck! Nov 28, 2013 at 13:34
  • I wanted to learn windows driver development and i don't know if i am wrong but i learn by developing things and this license system has all networking, cryptography what ever it could be possible i want to implement sorry if i am wrong with my approach Nov 28, 2013 at 13:43
0

Typecasts ULONG to HANDLE and vice versa. There are Helper Functions which you can use (since 2019): https://learn.microsoft.com/en-us/windows/win32/winprog64/the-tools

Usage typecast from ULONG to HANDLE: HANDLE MyHandle // eg PID ULONG MyDecVal MyHandle = LongToHandle (MyDecVal);

Usage typecast from HANDLE to ULONG: HANDLE MyHandle // eg PID ULONG MyDecVal MyDecVal = HandleToUlong (MyHandle);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.