A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #18538  by takep
 Fri Mar 15, 2013 10:09 am
Hello!

Could you share the easiest, may be documented, techniques to call usermode code from kernel space? Something like KeUsermodeCallback?
 #18547  by EP_X0FF
 Sat Mar 16, 2013 4:31 am
takep wrote:easiest, may be documented, techniques to call usermode code from kernel space
Switch back to usermode in current thread, execute code there and get back? I don't think such exists, otherwise there will be no KeUserModeCallback. I suggest you reconsider your code to remove requirement of such call. Use syncronization objects for example.
 #18612  by Fabian Wosar
 Wed Mar 20, 2013 5:41 pm
There are multiple routes you can go. You can abuse one of the documented methods for inter mode requests like for example the FltSendMessage API provided by the file system mini filter provider. It is intended to be used by file system mini filters but can technically be used by other drivers as well. You can also use LPC which is undocumented but there is quite a bit of unofficial documentation available (http://www.zezula.net/en/prog/lpc.html). If you don't like any of these solutions, you have to implement the callback yourself. This article over at OSR outlines the necessary steps and also contains a sample implementation:

http://www.osronline.com/article.cfm?id=94
 #18625  by takep
 Thu Mar 21, 2013 1:34 pm
Thanks for your answers! By the way, I want to ask one kinda related question. If I register some interrupt vector using IoConnectInterrupt, will it run if I do asm { int XX } command in usermode app?