32bit pointer <-> 64bit Kernel driver ?

GeminiServer

unread,

Jul 1, 2009, 4:41:50 AM7/1/09

to

Hi,

what's the best way to transport a 32bit data pointer to a 64bit kernel
driver and then **back.

I have 32bit dll, which has a 32bit Data pointer,
this should go into the 64bit kernel driver, which do something with it
and then **convert** the data 64bit pointer back to 32bit!

Is this possible and how to do it..

cheers, geminiserver

David Craig

unread,

Jul 1, 2009, 12:24:41 PM7/1/09

to

Maybe you should start with the first question. Why 'transport' a pointer?
There are many security issues with passing user mode pointers to kernel
mode. Why have a kernel driver do 'something' with a pointer? Most would
use the pointer to obtain access to memory it references. A pointer is just
a memory reference and even if converted to a process context free system
pointer still points to the same piece of memory.

"GeminiServer" <melih_...@hotmail.com> wrote in message
news:uE%238Hfi%23JHA...@TK2MSFTNGP04.phx.gbl...

Kerem Gümrükcü

unread,

Jul 1, 2009, 2:05:51 PM7/1/09

to

Hi,

i guess you read what David wrote. I personally
would pass the memory content to your driver
if it holds linear data (no other pointers included)
instead passing any pointer to your kernel code.
If the Data is not too big, thats what i would do,...

Regards

Kerem

--
--
-----------------------
Beste Grï¿œsse / Best regards / Votre bien devoue
Kerem Gï¿œmrï¿œkcï¿œ
Latest Project: http://www.pro-it-education.de/software/deviceremover
Latest Open-Source Projects: http://entwicklung.junetz.de
-----------------------
"This reply is provided as is, without warranty express or implied."

"GeminiServer" <melih_...@hotmail.com> schrieb im Newsbeitrag
news:uE#8Hfi#JHA....@TK2MSFTNGP04.phx.gbl...

Tim Roberts

unread,

Jul 2, 2009, 1:46:54 AM7/2/09

to

You may have a misunderstanding here. When you pass a 32-bit pointer into
a kernel driver and get a kernel (64-bit) address for it, BOTH addresses
remain valid. The kernel driver can write to the area, and when you return
back to the user-mode process, the 32-bit pointer is still valid.
--
Tim Roberts, ti...@probo.com
Providenza & Boekelheide, Inc.

GeminiServer

unread,

Jul 8, 2009, 8:41:25 AM7/8/09

to

Kerem Gï¿œmrï¿œkcï¿œ schrieb:

> Hi,
>
> i guess you read what David wrote. I personally
> would pass the memory content to your driver
> if it holds linear data (no other pointers included)
> instead passing any pointer to your kernel code.
> If the Data is not too big, thats what i would do,...
>
> Regards
>
> Kerem
>

Hi Kerem,

how can i copy the memory content from a 32-bit pointer?
e.g.:
//############################################################

UCHAR* dataPtr;
uint32_t Data32; //holding the pointer to the 32-bit message
RtlCopyMemory( dataPtr, Data32, DataLength ); //this will crash (Data
has no valid 64-bit pointer )
RtlCopyMemory( dataPtr, &Data32, DataLength ); // This will just copy
the Data32 pointer adress

//############################################################

cheers,
geminiserver

Tim Roberts

unread,

Jul 9, 2009, 10:37:37 PM7/9/09

to

GeminiServer <melih_...@hotmail.com> wrote:
>
>how can i copy the memory content from a 32-bit pointer?
>e.g.:
>//############################################################
>
>UCHAR* dataPtr;
>uint32_t Data32; //holding the pointer to the 32-bit message
>RtlCopyMemory( dataPtr, Data32, DataLength ); //this will crash (Data
>has no valid 64-bit pointer )
>RtlCopyMemory( dataPtr, &Data32, DataLength ); // This will just copy
>the Data32 pointer adress
>
>//############################################################

You SHOULD do it exactly as you would do it in a 32-bit driver, by calling
MmProbeAndLockPages to get a safe kernel address.

However, as long as you are in the same process context, you can use that
32-bit pointer in your 64-bit driver without doing anything special. Just
call ProbeForRead first, as usual. If you are really getting a 32-bit
unsigned long in your structure, you'll have to cast it to a 64-bit
pointer:

UCHAR* userBuffer = (UCHAR*)(ULONGLONG)Data32;