A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #31838  by xjk220
 Sun Jul 15, 2018 2:28 pm
Hi all, i need to implement a wdm driver that needs to send kernel information back to user-mode. I am wondering whats better between using just normal structures for storing such information vs using linked lists and synchronization locks, what do you guys think about best efficiency between both methods ?

thanks in advanced
 #31839  by Brock
 Sun Jul 15, 2018 6:31 pm
Take a look at the Inverted Call Model. Instead of your usermode application using DeviceIoControl with a supplied IOCTL to the driver the driver queues event info to the usermode application, hence the name Inverted.