Accessing kernel memory from user mode (windows) -

i'm writing driver needs allocate non paged pool of memory , memory, performance sake, must directly accessible usermode program.

in driver entry i've allocated memory 2 type of methods

pmdl = ioallocatemdl(null,                      4096,                      false,                      false,                      null); if(!pmdl) {     dbgprintex(dpfltr_ihvvideo_id, dpfltr_info_level, "error on ioallocatemdl. returning driver early.\n");     return status_insufficient_resources; } mmbuildmdlfornonpagedpool(pmdl); usermemory = (void *)mmmaplockedpagesspecifycache(pmdl, usermode, mmwritecombined, null, false, lowpagepriority); 

and

usermemory = exallocatepoolwithtag(                 nonpagedpool,                 4096,                 pool_tag); 

now don't want issue deviceiocontrol every time need write/read memory instead want this

char* sharedmem; ..... transactionresult = deviceiocontrol ( hdevice,                         (dword) ioctl_mmap,                         null,                         0,                         sharedmem,                         sizeof(int),                         &bretur,                         null                         ); ..... sharedmem[0]='c'; 

using deviceiocontrol address in kernel memory , using directly, mmap under linux.

is there kind of way in windows?

---------------edit 1 i've done this

hmapfile = openfilemapping(                 file_map_all_access,          // read/write access                 true,                                       "global\\sharedmemory");                 // name of mapping object  lasterror = getlasterror(); if (hmapfile == null) {     printf("could not create file mapping object (%d).\n" ,getlasterror());     return 1; } pbuf = (char*)mapviewoffile(hmapfile,   // handle map object                             file_map_all_access, // read/write permission                             0,                             0,                             4096);  if (pbuf == null) {     printf("could not map view of file (%d).\n", getlasterror());     closehandle(hmapfile);     return 1; } pbuf[0] = 'c'; pbuf[1] = '\n'; closehandle(hmapfile); 

and i've created view in kernel this

rtlinitunicodestring(&name, l"\\basenamedobjects\\sharedmemory"); initializeobjectattributes(&oa, &name, 0, 0, null); zwcreatesection(&hsection, section_all_access, &oa, &li, page_readwrite, sec_commit, null);  zwmapviewofsection(hsection, ntcurrentprocess(),                      &usermem, 0, mem_width, null,                     &j, viewshare, 0, page_readwrite); 

but in kernel when read memory it's empty: can may be?

i understood how need work.

first i've created structure following

typedef struct _memory_entry {     pvoid       pbuffer;          } memory_entry, *pmemory_entry; 

this used return virtual address kernel space user space

in driverentry used

usermem = exallocatepoolwithtag(nonpagedpool,                                 mem_width,                                  pool_tag ); 

to set nonpaged memory. i've created ioctl working in direct_out mode following snippet

... pmdl                mdl = null; pvoid               buffer = null; memory_entry        returnedvalue; void*               uservirtualaddress = null; ... buffer = mmgetsystemaddressformdlsafe(irp->mdladdress, normalpagepriority); //gets safely pointer output in irp mdl = ioallocatemdl( usermem,mem_width, false, false, null ); //allocate memory descriptor list mmbuildmdlfornonpagedpool(mdl); //this needed when we're managing nonpaged memory uservirtualaddress = mmmaplockedpagesspecifycache(                                           mdl,                                           usermode,                                            mmnoncached,                                           null,                                           false,                                            normalpagepriority); //return virtual address in context of                                                                 //the user space program called ioctl  returnedvalue.pbuffer = uservirtualaddress; rtlcopymemory(buffer,             &returnedvalue,             sizeof(pvoid));   //i copy virtual address in structure returned                               //to user mode program irp 

in user mode program needed to this

transactionresult = deviceiocontrol ( hdevice,                         (dword) ioctl_mmap,                         null,                         0,                         sharedmem,                         sizeof(void*),                         &bretur,                         null                         ); 

in (memory_entry*)sharedmem->pbuffer find memory area created , shared kernel space directly accessible kernel , user program

i haven't wrote need remember wrap entire mmgetsystemaddressformdlsafe(...)----->rtlcopymemory(...) in try...except block because can encounter various problems here may cause bugcheck better safe sorry. anyway, if you're compiling kind of code in checked environment ms autocodereview pointing out.

if need more clarifications, or if wrote wrong let me know , happy modify post.