Minifilter - send unicode string to user

NTFSD
1

I am using the scanner sample minifilter to create a driver. I added a field to the
_SCANNER_NOTIFICATION structure to send the file name and process id to the
usermode app so that it now looks like this:

typedef struct _SCANNER_NOTIFICATION {
ULONG BytesToScan;
ULONG Reserved;
UCHAR Contents[SCANNER_READ_BUFFER_SIZE];
int procId;
ULONG FileNameLength;
WCHAR FileName[256];
} SCANNER_NOTIFICATION, *PSCANNER_NOTIFICATION;

Now I want FileName to hold the path of the scanned file.
So I get the nameInfo->Name but it’s UNICODE_STRING which I am unable to put it’s value in WCHAR FileName[256].

I guess I need to use RtlStringCbCopyUnicodeString but It says “‘RtlStringCbCopyUnicodeString’ undefined; assuming extern returning int”.
status = RtlStringCbCopyUnicodeString(
notification->FileName
, sizeof(notification->FileName)
, &nameInfo->FinalComponent);

How do I include and use RtlStringCbCopyUnicodeString?

Thanks.

2

Are you forget to include the ‘ntstrsafe.h’ header?

#include <ntstrsafe.h>
…</ntstrsafe.h>

3

Thanks Aleh. I was missing that include (new to drivers development)
Now at user mode I try to print it and I get nothing
std::wcout << notification->FileName << std::endl;

At kernel I first do:
FltParseFileNameInformation(nameInfo);

then:
status = RtlStringCbCopyUnicodeString(
notification->FileName
, sizeof(notification->FileName)
, &nameInfo->Name);
whats wrong?

4

Look at the UNICODE_STRING declaration in the MSDN page:

typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;

Buffer is a pointer. But pointers to the kernel memory are inaccessible
from the user mode. Perhaps you need to redesign communication api.

5

For example, you may convert a string to array of characters and then
send this string to user mode process.

6

serg, you may check on how simRep sample allocates a UNICODE_STRING if you are going to send it to user mode. look at the usage and deffinition of SimRepAllocateUnicodeString in that minifilter sample

7

Thanks everyone for help.