Share Event with Usermode

[Frank Jensen]

I created an Event with IoCreateNotificationEvent.
I am able to access it from the user mode but read- only.
How can I create an event which is fully accessable
from user and kernel mode ?

Thank you,
Frank

[Felix Kasza [MVP]]

Frank,

> I created an Event with IoCreateNotificationEvent.
> I am able to access it from the user mode but read- only.

Use ZwCreateEvent() instead, then call ObReferenceObjectByHandle().
ZwCreateEvent() is documented in Gary Nebbett's "Windows NT/2000 Native
API Reference".

--

Cheers,
Felix.

If you post a reply, kindly refrain from emailing it, too.
Please consider migrating to microsoft.public.platformsdk.*
where the MS folks plan on hanging around. See you there!

[Frank Jensen]

Hi Felix,
Thank you for four reply.
That combination was the first thing I tried but it failed.
Probably because I never really understood how to
use ObReferenceObjectByHandle. I will try it again
today.

Bye,
Frank

P.s. Gary Nebbetts book is really handy isn't it ?

"Felix Kasza [MVP]" <fel...@mvps.org> schrieb im Newsbeitrag
news:3a2877a0....@207.46.180.24...

[Frank Jensen]

Hi all,

I tried it again but it still doesn't work.
The event is read- only from user mode.

Here's what I've done :

InitializeObjectAttributes(&EventAttributes,
&name,
OBJ_CASE_INSENSITIVE,
NULL,
NULL);

Status = ZwCreateEvent(&hEvent,
EVENT_ALL_ACCESS,
&EventAttributes,
NotificationEvent,
TRUE);

Status = ObReferenceObjectByHandle(hEvent,
EVENT_ALL_ACCESS,
0,
KernelMode,
&kEvent,
0);

Is there something wrong with the code ??

Thank you,
Frank

"Frank Jensen" <f...@stueber.de> schrieb im Newsbeitrag
news:#9rQW42WAHA.280@cppssbbsa05...

[Felix Kasza [MVP]]

Frank,

you never said anything about the users creating/accessing your event.
Methinks you need a valid security descriptor with a properly filled-in
DACL in your OBJECT_ATTRIBUTES.