CODEWITHSUNDEEP
kerneldriverminifilter
GSP
GSP

Reputation: 584

Minifilter: how to run application from kernel mode

Now, I'm working with minifilter in kernel-mode. I want to run an application ( system application such as: notepad.exe, mspaint.exe or an application which is made by user such as: C# application ...).

My questions are:

  1. Can I run application from kernel?
  2. If can, how should I do?

Happy new year !

Thanks all

[EDIT]

I create a windows service (C#) to communicate between them (Minifilter (C) and Application (C#, C/C++))

  1. Windows service will start app ==> Done. It will execute after get and check message from minifilter.

  2. Minifilter send message to service

  3. [Minifilter] Create communication port

  4. [Minifilter] Send message to service after check conditions

  5. [Service] Get message from this port by FilterGetMessage

    ==> How using FilterGetMessage in C#?

UPDATE: I used

  1. FltSendMessage at driver to send message to service

  2. FilterGetMessage at service to get message from driver

==> But the message buffer is null although the status is success (status = 0)

What is not correct?

P/S: The message content is a file name.

Upvotes: 0

Views: 1672

Answers (1)

dvasanth
dvasanth

Reputation: 1377

Windows Minifilter has framework to send & receive message from a usermode application. Check this api: FilterSendMessage for more information on the communication mechanism. Using this, you can send notification to a user mode app to start an application.

Upvotes: 0

Related Questions