none
Memory mapping file for driver usage RRS feed

  • Question

  • Is it possible to make a file available in usb flash drive available in kernel mode space ?

    I have a firmware related file in usb flash drive and this has to be accessed by kmdf driver.

    Should the file mapping be done in app or can it be done in driver ?

    will the below functions work ?

    ZwCreateFile,
    ZwCreateSection, ObReferenceObjectByHandle, and MmMapViewInSystemSpace


    • Edited by Rexlin S Wednesday, March 18, 2020 5:11 PM
    Wednesday, March 18, 2020 4:55 PM

Answers

  • Yes, it can be done; however, validating the contents and format of the file in kernel-mode can be difficult. The sequence that you need is: ZwCreateFile, ZwQueryInformationFile, ZwCreateSection, ZwMapViewOfSection

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Wednesday, March 18, 2020 6:17 PM
    Moderator