Home/ Questions/Q 621169
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T18:50:42+00:00

I’ll try to be brief, but fully descriptive: This is Windows-specific. Using the Windows

  • 0

I’ll try to be brief, but fully descriptive:

This is Windows-specific. Using the Windows Driver Development Kit (DDK).

I am writing a Kernel Mode Driver (KMD) for the first time, having no prior experience in Kernel Mode. I am playing around currently with the “scanner” mini-filter sample which comes with the DDK, and expanding upon it for practice. The “scanner” mini-filter is a basic outline for a generic “anti-virus” type scanning driver which hooks file creates/closes and operates on the associated file to scan for a “bad word” before approving/denying the requested operation.

The end goal is to scan the file with the user-mode application when it is opened, deciding whether or not the mini-filter should allow the operation to complete, without noticeable slow-down to the process or user which is attempting to open the file. I will also want to scan the entire file again when a save is attempted to decide whether or not to allow the save to complete successfully or deny the save. The mini-filter sample lays out the groundwork for how to hook these calls, but is a bit weak in the actually “scanning” portion.

I am looking at expanding the sample to scan the entire file that has been opened, such as to generate a hash, rather than just the first 1k (the sample’s limit). I have modified the sample to read the entirety of the file and send it using the same mechanisms within the original sample. This method uses FltReadFile to read the file within the KMD and FltSendMessage to send the buffer to the user-mode component. The user-mode application is using GetQueuedCompletionStatus to grab the notifications from the KMD and process the buffers.

However, I’m noticing that this process seems to be pretty slow compared to a normal open/read in C++ using the standard library (fstream). This method is taking between approximately 4-8 times longer than simplying opening and reading the file in a simple C++ user app. I have adjusted buffer sizes to see if it makes for a noticeable improvement, and while it can help slightly, the benefits have not appeared to be very significant.

Since I am looking to scan files in ‘real-time’, this rate of transfer is highly disappointing and prohibitive. Is there a faster way to transfer a file’s contents from a Kernel-Mode Driver to a User-Mode Application?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I can suggest several solutions:

    1. Use DeviceIoControl with METHOD_OUT_DIRECT transfer type to pass large amounts of data.
    2. Create memory section and map it to your process (remember about limited address space on 32-bit platforms).
    3. Pass file path to your application and open it there.
    • 0