I need help. I am reversing Procmon64.exe file. It drops procmon.Sys filesystem minifilter driver which does monitoring.

Question: I need to know if filtering of events is done in user-mode or kernel-mode.

My hypothesis is that all events are sent to user-mode application and then are filtered and displayed.

For now i breakpointed procedure that calls FilterGetMessage but can't figure out if it returns all events or just filtered events.

Thank You.

  • Here is the docs about FilterGetMessage function.
    – Biswapriyo
    Aug 22 '19 at 14:31
  • Thanks. Have read that. According to that article FltSendMessage sends message to FilterGetMessage, still don't have clue if user-mode sends the driver filtering conditions. If it does it should happen in FilterConnectCommunicationPort or FilterSendMessage no?
    – guest
    Aug 22 '19 at 15:12
  • Hi and welcome to RE.SE. There are dozens of ways to communicate something between user and kernel mode in Windows. I concur with your hypothesis, but only actual reverse engineering will tell. It makes sense for user mode to do the filtering for two reasons: 1. user mode doesn't have the memory limitations (NonPagedPool in particular) kernel mode code has and 2. the way the filtering works, most driver developers in their right mind would opt to run that in user mode rather than risk doing these operations in kernel mode. Obviously it can be done, but not everything possible is a good idea.
    – 0xC0000022L
    Aug 23 '19 at 20:01

Most likely the driver only monitors events and send messages to user mode. This approach is used in Microsoft driver samples. If I remember correctly - that it is: https://github.com/microsoft/Windows-driver-samples/blob/master/filesys/miniFilter/scanner

I think it is good example to understand mini-filter driver and user mode app communication.

  • Yeah, probably.
    – guest
    Aug 23 '19 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.