Named Pipe Kernel Security

  • Article

This automated test verifies that only kernel-mode requestors can invoke SCTL_PIPE_INTERNAL_TRANSCEIVE, because this command can read kernel memory.

Test details

   
Specifications
  • Filter.Driver.FileSystem.MiniFilter
  • Filter.Driver.AntiVirus.MiniFilter
  • Filter.Driver.FileSystem.NamedPipeAndMailSlots
  • Filter.Driver.AntiVirus.NamedPipeAndMailSlots
Platforms
  • Windows 10, client editions (x86)
  • Windows 10, client editions (x64)
  • Windows Server 2016 (x64)
Supported Releases
  • Windows 10
  • Windows 10, version 1511
  • Windows 10, version 1607
  • Windows 10, version 1703
  • Windows 10, version 1709
  • Windows 10, version 1803
  • Windows 10, version 1809
  • Windows 10, version 1903
  • Next update to Windows 10
Expected run time (in minutes) 30
Category Development
Timeout (in minutes) 1800
Requires reboot false
Requires special configuration false
Type automatic

 

Additional documentation

Tests in this feature area might have additional documentation, including prerequisites, setup, and troubleshooting information, that can be found in the following topic(s):

Running the test

Before you run the test, complete the test setup as described in the test requirements: File System Testing Prerequisites.

To run this test, follow these steps:

  1. Copy the test binaries that are listed in the File List section locally.

  2. Run the following command: npfsregr.exe

  3. The expected Pass count is 1. Inspect the log file for the presence of +SEV error tags. If you do not find any instances of this tag, the test has passed.

Troubleshooting

For generic troubleshooting of HLK test failures, see Troubleshooting Windows HLK Test Failures.

For troubleshooting information, see Troubleshooting File System Testing.

This test returns Pass or Fail. To review test details, review the test log from Windows Hardware Lab Kit (Windows HLK) Studio.

More information

Command syntax

This test does not accept command-line parameters.

File list

File Location

Npfsregr.exe

[WTT\TestBinRoot]\NTTEST\BASETEST\kernel\misc\npfsregr.exe

Ntlog.dll

[WTT\OsBinRoot]\ddk_flat\DTM\tests\ntlog\ntlog.dll

Ntlogger.ini

[WTT\OsBinRoot]\ddk_flat\DTM\tests\ntlog\ntlogger.ini

 

Parameters

Parameter name Parameter description
LLU_LclAdminUser LLU for Execute
LLU_NetAccessOnly LLU for Copy