0

I need help. I am reversing Procmon64.exe file. It drops procmon.Sys filesystem minifilter driver which does monitoring.

Question: I need to know if filtering of events is done in user-mode or kernel-mode.

My hypothesis is that all events are sent to user-mode application and then are filtered and displayed.

For now i breakpointed procedure that calls FilterGetMessage but can't figure out if it returns all events or just filtered events.

Thank You.

  • Here is the docs about FilterGetMessage function. – Biswapriyo Aug 22 at 14:31
  • Thanks. Have read that. According to that article FltSendMessage sends message to FilterGetMessage, still don't have clue if user-mode sends the driver filtering conditions. If it does it should happen in FilterConnectCommunicationPort or FilterSendMessage no? – guest Aug 22 at 15:12
  • Hi and welcome to RE.SE. There are dozens of ways to communicate something between user and kernel mode in Windows. I concur with your hypothesis, but only actual reverse engineering will tell. It makes sense for user mode to do the filtering for two reasons: 1. user mode doesn't have the memory limitations (NonPagedPool in particular) kernel mode code has and 2. the way the filtering works, most driver developers in their right mind would opt to run that in user mode rather than risk doing these operations in kernel mode. Obviously it can be done, but not everything possible is a good idea. – 0xC0000022L Aug 23 at 20:01
0

Most likely the driver only monitors events and send messages to user mode. This approach is used in Microsoft driver samples. If I remember correctly - that it is: https://github.com/microsoft/Windows-driver-samples/blob/master/filesys/miniFilter/scanner

I think it is good example to understand mini-filter driver and user mode app communication.

  • Yeah, probably. – guest Aug 23 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.