A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #23124  by Carlbyte
 Mon Jun 16, 2014 2:36 pm
I'm trying to send messages to an application using functions fltkernel.h. I tried several changes but could not make it work.

in the driver


X.QuadPart = ((-1 * 10) * 1000) * 1000;
message.MessageId = 15;
message.ReplyLength = 12;
if NT_SUCCESS( FltSendMessage(fileManager.pFilter, &fileManager.ClientPort, &message, sizeof(FILTER_MESSAGE_HEADER), NULL/*&Reply*/, NULL/*&ReplyLength*/, &X) );
DbgPrint("Success!");

in App

HRESULT hResult = S_OK;
HANDLE Port;
FILTER_MESSAGE_HEADER message;
OVERLAPPED Ovlp;

hResult = FilterConnectCommunicationPort(FLPORTNAME, 0, NULL, 0, NULL, &Port);

message.MessageId = 0;
message.ReplyLength = 0;

while (true){
hResult = FilterGetMessage(Port, &message, sizeof(FILTER_MESSAGE_HEADER), NULL);//&Ovlp
printf("MessageId %d %d \n", message.MessageId, hResult);
}

Results

DebugView = Success! App Output = MessageId 0 0


Anyone with any tips?