Hi everyone, I have a minifilter kernel driver that needs to retrieve all '.exe' files being loaded by the OS. I can do that so far, however, I can only intercept the filenames when my userland service is running and connected to the driver (Communication Port). This means: I am missing all executable names that were launched from boot time until before my own service is run, and these are the ones I would like to intercept as well. My driver is set to 0x00000001 SERVICE_SYSTEM_START My idea is to: Put all services names (services launched before mine) in a buffer at a kernel level When my service connects to my driver, then I can stop adding to the buffer and send all the data to my service for processing. After further research, I read about several things: ExAllocatePoolMemory, Lookaside lists, not possible to use STL's vectors, not possible to use 'new'.... I just need to store these filenames in an array of WCHAR. I would greatly appreciate some help on that! Thank you.

Minifilter driver - buffer data kernel mode

David 211

Hi everyone,

I have a minifilter kernel driver that needs to retrieve all '.exe' files being loaded by the OS. I can do that so far, however, I can only intercept the filenames when my userland service is running and connected to the driver (Communication Port).

This means: I am missing all executable names that were launched from boot time until before my own service is run, and these are the ones I would like to intercept as well.
My driver is set to 0x00000001 SERVICE_SYSTEM_START

My idea is to:

Put all services names (services launched before mine) in a buffer at a kernel level
When my service connects to my driver, then I can stop adding to the buffer and send all the data to my service for processing.

After further research, I read about several things: ExAllocatePoolMemory, Lookaside lists, not possible to use STL's vectors, not possible to use 'new'....
I just need to store these filenames in an array of WCHAR.

I would greatly appreciate some help on that! Thank you.