Clipiboard in kernel mode?

NTFSD
1

Is kernel mode involved in the Windows clipboard at all or is that all in
user mode?

Is there a way to get a callback in kernel mode when the clipboard is read
from/written to?

Thanks.

2

Why? What are you trying to do? In the end you’re trying to share memory between user and kernel and that’s generally a bad solution/

Gary Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

On Apr 11, 2012, at 7:08 AM, Neil Weicher wrote:

Is kernel mode involved in the Windows clipboard at all or is that all in
user mode?

Is there a way to get a callback in kernel mode when the clipboard is read
from/written to?

Thanks.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

There’s some kernel mode involvement from Win32K, I believe. However, from a
developer’s perspective it’s a user mode concept so I don’t think there’s
any way to plug into it from kernel mode.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Neil Weicher” wrote in message news:xxxxx@ntfsd…

Is kernel mode involved in the Windows clipboard at all or is that all in
user mode?

Is there a way to get a callback in kernel mode when the clipboard is read
from/written to?

Thanks.

4

What problem are you trying to solve?
joe

Is kernel mode involved in the Windows clipboard at all or is that all in
user mode?

Is there a way to get a callback in kernel mode when the clipboard is read
from/written to?

Thanks.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

Clipboard is per-windows stations (user-mode/win32k.sys) and it has nothing
to do with kernel mode.
Antiloggers usually hook NtUser(Get/Set)ClipboardData fncs to monitor
clipboard activity.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Neil Weicher
Sent: Wednesday, April 11, 2012 2:09 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Clipiboard in kernel mode?

Is kernel mode involved in the Windows clipboard at all or is that all in
user mode?

Is there a way to get a callback in kernel mode when the clipboard is read
from/written to?

Thanks.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

On 4/11/2012 3:30 PM, Petr Kurtin wrote:

Clipboard is per-windows stations (user-mode/win32k.sys) and it has nothing
to do with kernel mode.

Not exactly true. The Windows clipboard is implemented using shared
memory in session space. Clipboard objects are copied to and from user
memory to this shared memory. In principle you should be able to attach
to a session from kernel mode and address clipboard memory directly,
assuming you know the location of the shared base. Of course there is
no support for doing this and it not something that should be done by a
commercial product. However, it can be done.